WordPress Count Per Day plugin version 3.5.4 suffers from a persistent cross site scripting vulnerability.