The vulnerability is an Improper Neutralization of Input During Web Page Generation that allows attackers to inject arbitrary HTML and JavaScript into pages served by the Marketing Automation plugin. A reflected XSS flaw enables malicious code to execute in the browser of any user who views a crafted page or link, potentially leading to session hijacking, credential theft, or redirection to phishing sites. This weakness is identified by CWE-79 and poses a client‑side code execution risk.

The flaw affects the vbout Marketing Automation plugin for WordPress, versions from the initial release through and including 1.2.6.8. All WordPress sites that have this plugin installed and have not applied a later update are susceptible.

The CVSS score of 7.1 indicates a high impact, while the EPSS score of less than 1 % suggests exploitation is unlikely at this moment. The vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the flaw by crafting a malicious URL that includes unfiltered input, causing it to be reflected in the page response. No specific authentication or elevated privileges are required; the threat is remote and depends on the victim’s interaction with the reflected content.