The Advance WP Query Search Filter WordPress plugin version 1.0.10 and earlier contains an unsanitized and unescaped parameter that is echoed back in the page. This flaw allows a malicious user to inject JavaScript that executes in the context of privileged users such as administrators, compromising the confidentiality and integrity of the site. The weakness is a classic reflected cross‑site scripting flaw and corresponds to CWE‑79.

WordPress installations using the Advance WP Query Search Filter plugin up to and including version 1.0.10 are affected.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% suggests low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to craft a URL containing the vulnerable counter parameter and have the target high‑privilege user visit it. Once the script runs, the attacker could deface the site, steal session cookies, or perform other malicious actions within the user’s session.