The Tainacan plugin for WordPress is vulnerable to reflected cross‑site scripting because the 'search' parameter is not properly sanitized or escaped when generating output. An attacker can embed malicious JavaScript into this parameter, which will be reflected back to the browser in search result pages. If a user clicks a crafted link, the script will execute in the context of that user, potentially allowing the attacker to steal session cookies, deface the site, or perform other client‑side attacks.

All installations of the Tainacan plugin for WordPress, version 1.0.0 and earlier, are affected. The vulnerability is present in every release up to and including 1.0.0.

The CVSS score is 6.1, indicating moderate severity. The EPSS score is less than 1 %, implying a very low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it by enticing a user to visit a specially crafted URL containing the malicious search query; no authentication is required. Because the payload is reflected directly into the response, the attack does not depend on server configuration beyond the presence of the vulnerable parameter.