Improper neutralization of input during web page generation allows an attacker to inject arbitrary JavaScript that will execute in the context of the victim’s browser. This reflected XSS flaw permits the execution of unseen code, potentially leading to session hijacking, defacement, or redirection. The weakness is classified as CWE‑79 and does not require authentication to the target site, making it accessible through crafted URLs or form submissions.

The vulnerability affects the WordPress plugin Wp advertising management by Simone Marcon. Versions from the initial release through 1.0.3 are susceptible. Users running any of these versions are at risk unless the plugin is upgraded or removed.

The CVSS score of 7.1 classifies this flaw as high severity, while an EPSS score of less than 1% indicates a low probability of being actively exploited today. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by delivering a crafted link or input that is reflected back to the user’s browser, which does not require privileged access. The lack of input sanitization makes the exploitation straightforward for anyone with the ability to influence the page content.