The WP‑OAuth plugin for WordPress allows attackers to inject arbitrary JavaScript into pages when the error_description query parameter is not properly sanitized or escaped. This reflected cross‑site scripting flaw can be exploited by an unauthenticated user merely by luring an audience to visit a crafted URL. If the victim follows the link, the injected script runs in the victim’s browser, potentially allowing session hijacking, defacement, or the theft of sensitive data.

All installations of the WP‑OAuth plugin for WordPress versions up to and including 0.4.1 are affected. The plugin is distributed by hectavex under the product name WP‑OAuth.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% suggests a low exploitation probability as of the latest data. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation yet. Attackers do not need privileged access; they can target any user who clicks a malicious link through the vulnerable error_description parameter. Because the flaw is a classic reflected XSS vulnerability (CWE‑79), its impact is confined to user browsers and can be mitigated with proper input validation or plugin updates.