The etruel WP Views Counter plugin up to version 2.0.3 suffers from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows an attacker with low privileges and requiring user interaction to execute arbitrary scripts in the context of the affected site, potentially impacting confidentiality, integrity, and availability. The vulnerability is tracked as CVE-2025-49859 with a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No patch or remediation details have been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability can allow an attacker to execute stored malicious scripts within the context of the affected website, potentially leading to partial compromise of confidentiality, integrity, and availability of the site or user data. The attack requires low privileges and user interaction, and the scope is changed (S:C), meaning the vulnerability can affect resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting user input capabilities or applying web application firewall (WAF) rules to detect and block malicious payloads related to stored XSS in the WP Views Counter plugin. Monitor vendor channels for updates and apply patches promptly once released.