The Complag plugin for WordPress exposes a reflected cross‑site scripting (XSS) flaw through the `$_SERVER['PHP_SELF']` variable. Because input is not properly sanitized and output is not escaped, an unauthenticated attacker can craft a link that, when clicked by a victim, injects arbitrary JavaScript into the page. The injected script runs in the context of the site, allowing the attacker to steal session cookies, deface content, or facilitate further phishing attacks.

These issues affect the Complag WordPress plugin, version 1.0.2 and earlier, developed by andru1. Any WordPress site that has this plugin installed—without applying a newer version that eliminates the vulnerable code—remains impacted.

The CVSS base score of 6.1 classifies the vulnerability as Moderate, and the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The plugin is not listed in CISA’s KEV catalog. The attack vector appears to be unauthenticated, driven by a user clicking a malicious link that triggers the vulnerable `$_SERVER['PHP_SELF']` output. Attackers must rely on social engineering to convince a user to load the page, after which malicious JavaScript executes with the victim’s browser privileges.