The VR‑Frases plugin for WordPress is vulnerable to reflected Cross‑Site Scripting through multiple request parameters across all versions up to and including 3.0.1. Insufficient input sanitization and output escaping allow an attacker to embed arbitrary scripts in responses that execute when a victim clicks a crafted link. This vulnerability is a classic CWE‑79 exploit and grants attackers the ability to hijack user sessions, deface sites, or deliver phishing content, exposing confidential data and user credentials to the attacker.

The vulnerability affects the VR‑Frases WordPress plugin, developed by vruizg, with all releases numbered 3.0.1 or earlier. Sites that have installed any of these affected versions and have the plugin activated are at risk; newer releases beyond 3.0.1 are not listed as vulnerable.

The CVSS score of 6.1 denotes medium severity, while the EPSS score of <1% indicates a low probability of exploitation in the wild, and the flaw is not currently listed in the CISA KEV catalog. Nonetheless, the attack vector is straightforward: an unauthenticated attacker can embed malicious scripts in a URL that, when a visitor clicks it, triggers script execution in the visitor’s browser. Given the ubiquitous use of WordPress and the plugin’s functionality, this flaw can be leveraged for social‑engineering campaigns or automated attacks targeting site visitors.