Improper neutralization of input during web page generation leads to a reflected cross‑site scripting vulnerability in the CloudFlare(R) Cache Purge plugin. The flaw permits execution of arbitrary client‑side script code when a user visits a page containing the unescaped input. Because the vulnerability is a CWE‑79 weakness, it can potentially compromise the confidentiality of user data or allow an attacker to hijack browser sessions.

The affected product is the CloudFlare(R) Cache Purge WordPress plugin developed by shanaver. All releases from the earliest available version up to and including 1.2 are vulnerable. This includes any installation running version 1.2 or earlier, since the CVE description provides no further version granularity.

The CVSS score of 7.1 classifies the issue as high severity, but the EPSS score of less than 1% indicates a very low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web‑based, and based on the description, it is inferred that an attacker may need to supply malicious input that is reflected in the rendered page to trigger script execution.