CVE-2026-0741 describes a stored cross-site scripting vulnerability in the Electric Studio Download Counter plugin for WordPress, present in all versions up to and including 2.4. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of plugin settings input. Authenticated attackers with Administrator privileges can inject malicious scripts that execute in the context of users visiting the affected pages. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, scope changed, and low confidentiality and integrity impact with no availability impact.

Successful exploitation allows an authenticated administrator-level user to inject persistent malicious scripts into plugin-managed pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed in the context of other users. There is no direct impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator-level access to trusted users only. Monitor plugin updates from Electric Studio and apply any official patches promptly once available. Avoid using the plugin settings interface for untrusted input.