The Stumble! for WordPress plugin is vulnerable to a reflected cross‑site scripting flaw caused by the use of the raw $_SERVER['PHP_SELF'] variable without proper sanitization or output escaping. An unauthenticated attacker can embed malicious JavaScript in the page when a user follows a crafted URL or link that includes the attacker’s code. This can lead to cookie theft, session hijacking, defacement, or malicious redirection, thereby compromising the confidentiality, integrity, and availability of the site for any visiting user. The vulnerability is a typical example of a client‑side injection weakness (CWE‑79).

The affected product is the "Stumble! for WordPress" plugin, distributed by mitchoyoshitaka. All releases up to and including version 1.1.1 are impacted. Any WordPress installation that has this plugin active and serves pages that echo $_SERVER['PHP_SELF'] in the response will be vulnerable.

The CVSS score is 6.1, indicating a moderate severity. The EPSS score of less than 1% suggests that current exploitation activity is low, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via a crafted link or URL that forces the vulnerable plugin to output the unsanitized string to the user’s browser. The attack requires no authentication; an attacker only needs to entice a victim to click the malicious link, which can be delivered through email, social media, or compromised sites.