The flaw stems from improper neutralization of input during web page generation, allowing Reflected Cross‑Site Scripting. When the WP Query Creator plugin processes user‑supplied query parameters, it fails to encode or filter the data, so malicious scripts can be echoed back to the client. As a result, an attacker can make code execute in a victim’s browser when the victim follows a crafted link.

Affected are sites that run the Patel WP Query Creator WordPress plugin, versions up to and including 1.0. WordPress installations that have the plugin installed and use it to handle query strings are vulnerable. No other vendors or products are mentioned.

The CVSS base score is 7.1, indicating a high‑severity risk that can be triggered remotely. EPSS is less than 1%, implying a low but non‑zero chance of exploitation. The vulnerability is not currently in the CISA KEV list. The likely attack vector is an attacker creating a link with malicious input; when a user clicks it, the script runs in the browser.