The vulnerability is an improper neutralization of input during web page generation, classified as a reflected cross‑site scripting flaw. When an attacker manipulates a URL or form field that is returned to the user without proper encoding, malicious JavaScript can run in the victim’s browser. This can enable credential theft, session hijack, or other client‑side attacks. The weakness is a classic input validation failure identified as CWE‑79.

All installations of Kyle Phillips’ Simple Locator plugin for WordPress that are at or below version 2.0.4 are vulnerable. The plugin can be present on any WordPress site that has opted to use the locator feature, potentially affecting a broad swath of public websites.

The CVSS score of 7.1 indicates a high impact if exploited. The EPSS score of less than 1% suggests that, at the time of analysis, exploitation attempts are rare, and the vulnerability is not currently listed in CISA’s KEV database. Attackers could execute the flaw through unauthenticated requests to the plugin’s endpoint, leveraging reflected XSS to inject malicious scripts into users’ browsers. The relatively low EPSS and absence from KEV imply that while the risk is real, immediate exploitation activity is unlikely. However, the high CVSS warrants proactive mitigation.