An improper neutralization of user input in the OZ Canonical WordPress plugin allows a reflected cross‑site scripting (XSS) flaw that could let an attacker inject malicious scripts into a page viewed by other users. The weakness is classified as CWE‑79 and can be used to perform actions such as cookie theft, session hijacking, or defacement in the victim’s browser context.

The vulnerability affects the Andon Ivanov OZ Canonical plugin for WordPress, specifically versions 0.5 and earlier. Any WordPress installation that has this plugin enabled and is using a version <=0.5 is at risk.

The CVSS score of 7.1 indicates moderate severity, and the EPSS score of <1% suggests exploitation is unlikely but possible. The flaw is not listed in the CISA KEV catalog. Attackers could trigger the reflected XSS by manipulating query parameters or form inputs that the plugin reflects back to the page, enabling script execution in the context of an authenticated or unauthenticated visitor.