The r-win WP-DownloadCounter plugin suffers from a CSRF vulnerability that enables attackers to execute stored XSS attacks by tricking authenticated users into submitting unauthorized requests. This affects all versions up to 1.01. The vulnerability has a CVSS 3.1 score of 7.1, reflecting network attack vector, low attack complexity, no privileges required, but requires user interaction and results in a scope change with low confidentiality, integrity, and availability impacts.

Successful exploitation could allow attackers to inject malicious scripts that persist in the application, potentially leading to session hijacking, defacement, or other client-side attacks. The impact includes limited confidentiality, integrity, and availability loss as indicated by the CVSS vector. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to trusted users only. Applying web application firewall (WAF) rules to detect and block CSRF and XSS attempts may provide temporary mitigation.