The Adsmonetizer plugin contains an input field that is not properly sanitized, enabling an attacker to inject malicious scripts that are reflected back to the user. This reflected XSS flaw can allow arbitrary JavaScript execution within victims’ browsers, potentially leading to cookie theft, session hijacking, or defacement of the site content. The vulnerability is triggered when user‑supplied data appears unescaped in the generated web page.

The vulnerability impacts the WordPress Adsmonetizer plugin provided by Jose Fernandez, affecting all releases through version 3.2.4. Site owners running these versions are at risk if the plugin processes untrusted input without proper escaping.

The CVSS score of 7.1 indicates moderate to high severity, and the EPSS score is not available, while the vulnerability is not listed in CISA KEV, suggesting it has not been broadly exploited in the wild. Based on the description, the flaw is triggered by reflected user input, implying the attack vector is a crafted URL or form entry that the plugin processes. The lack of an EPSS score and KEV listing limits the ability to gauge real‑world exploitation likelihood, but the moderate severity and the potential for arbitrary code execution warrant prompt remediation.