The JustClick registration plugin for WordPress contains an input sanitization flaw that allows attackers to execute reflected Cross‑Site Scripting via the server variable PHP_SELF. Unauthenticated adversaries can embed malicious scripts into pages that will run when a victim follows a crafted link, potentially leading to session hijacking, phishing, or defacement. The weakness is a classic reflection issue classified as CWE‑79 and relies on improper output escaping.

The vulnerability affects the JustClick registration plugin versions up to and including 0.1 released by ostin654. Any WordPress site that installs this plugin, regardless of the theme or other plugins, is susceptible when it uses the default PHP_SELF handling in the plugin code.

The CVSS base score of 6.1 indicates a medium overall impact, but the EPSS score of less than 1% reflects a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further signaling limited active exploitation. The likely attack vector is a social‑engineering attack that tricks a user into clicking a malicious link sent by an attacker. Because no authentication or privileged context is required, the potential damage depends largely on the content accessed by the victim and on any cross‑domain interactions they perform.