The vulnerability is an Improper Neutralization of Input During Web Page Generation, allowing an attacker to reflect malicious script into the browser of any user who views a crafted page. The reflected XSS could execute JavaScript within the victim’s context, potentially enabling data theft or site defacement. The description states that the flaw exists in the plugin’s handling of external input.

RiceTheme Felan Framework WordPress plugin 1.1.3 and earlier is affected. Users running any version up to and including 1.1.3 have the vulnerability.

The CVSS score of 7.1 indicates a high‑moderate risk level. No EPSS score is reported, and the CVE is not listed in the CISA KEV catalog. The attack vector is inferred to be a web‑based reflected XSS, likely through manipulation of GET or POST parameters that the plugin displays without proper escaping. Exploitation requires the victim’s browser to load the crafted URL; therefore it is user‑agent‑based but does not require elevation of privileges or network access.