Improper neutralization of input during web page generation has been identified in the KNR Author List Widget plugin. The flaw allows an attacker to embed malicious scripts into the HTML output by manipulating query parameters or form inputs, resulting in reflected XSS. This can enable session hijacking, cookie theft, defacement, or redirection of site visitors and administrators, thereby compromising both confidentiality and integrity of the site.

The WordPress plugin "KNR Author List Widget" created by Yamna Khawaja is affected. All installations running version 3.1.1 or older are impacted. The vulnerability affects typical WordPress deployments that include the widget on any page or post.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of fewer than 1% suggests a very low current exploitation probability. The plugin is not listed in the CISA KEV catalog. Attackers likely need to entice a user or an administrator to visit a crafted URL containing malicious payloads, a common reflected XSS attack scenario. If exploited, the attacker could gain temporary client‑side access, exfiltrate sensitive data or maintain a foothold for further attacks.