The Advance WP Query Search Filter WordPress plugin, for versions up to 1.0.10, fails to sanitize and escape a parameter before displaying it back to the browser. This allows a reflected Cross‑Site Scripting (XSS) attack. An attacker could inject malicious scripts that are executed in the context of high‑privilege users such as site administrators, potentially compromising account credentials, defacing content, or redirecting to phishing sites. The weakness is a classic input neutralization failure (CWE‑79).

This vulnerability affects the plugin named Advance WP Query Search Filter with all releases through 1.0.10. Users running an older or unpatched instance of the plugin are susceptible, including those deployed on any WordPress site.

The CVSS score of 6.1 indicates moderate severity. The EPSS score of less than 1 % suggests a low likelihood of widespread exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be the AJAX endpoint "taxo_ajax", which can be accessed by authenticated users with admin rights; an attacker who tricks such a user into opening a crafted link could trigger the reflected XSS. The mitigate‑and‑patch approach, combined with user‑role restrictions, is required to reduce risk.