The MDJM Mobile DJ Manager plugin for WordPress contains a reflected cross‑site scripting flaw that results in improper neutralization of user‑supplied input during page rendering. An attacker can inject arbitrary JavaScript into a page that is immediately returned, potentially leading to session hijacking, cookie theft, or other client‑side attacks. The underlying weakness is a failure to escape or encode output, classified as CWE‑79.

Any installation of the Mobile DJ Manager plugin up to and including version 1.7.5.6 is vulnerable, regardless of the underlying WordPress core version. Sites that have installed any version in that range are affected.

The reported CVSS score of 7.1 indicates a serious risk. With an EPSS score of less than 1 % the likelihood of automated exploitation is low, and the flaw is not currently listed in the CISA KEV catalog. The typical attack path requires an attacker to craft a URL or form submission that the plugin echoes back, so an unauthenticated user or one with permission to submit requests can trigger the vulnerability.