The Application Passwords WordPress plugin allows arbitrary JavaScript code to be injected through the reject_url parameter. Improper sanitization and escaping enable attackers to embed javascript: URI schemes, which can execute when a user clicks the ‘No, I do not approve of this connection’ button. This flaw permits attacker‑controlled script execution in the victim’s browser without authentication.

WordPress sites that have the Application Passwords plugin by georgestephanis installed in any version up to and including 0.1.3 are affected. Site administrators should verify their plugin version and update to a patched release beyond 0.1.3.

The CVSS score of 5.4 places this vulnerability in the medium severity range, and the EPSS score of less than 1% indicates that the exploitation probability is currently low. It is not listed in the CISA KEV catalog. The likely attack vector is a link‑based social‑engineering scheme where an attacker supplies a crafted reject_url to a victim, who is then tricked into clicking the approval button. Because the vulnerability is unauthenticated, any user who visits a malicious URL could be exposed.