The Amber plugin for WordPress contains an input sanitization flaw that allows attackers to inject arbitrary JavaScript into the page that is returned to the user. This reflected XSS can be triggered when a user visits a specially crafted URL or submits a form field that the plugin echoes back without proper escaping. The immediate impact is that attackers can steal session cookies, deface the website, or perform phishing attacks against users who view the vulnerable page. The weakness is a typical Cross‑Site Scripting flaw (CWE‑79).

WordPress sites that have the Berkman Klein Center Amber plugin installed, specifically versions up to and including 1.4.4. Any installation of Amber 1.4.4 or earlier is affected; newer versions are not listed as vulnerable.

The CVSS score of 7.1 classifies this as a high‑severity vulnerability. The EPSS score is below 1%, indicating that the probability of exploitation is very low at this time, and the vulnerability is not listed in the CISA KEV catalogue. Based on the description, it is inferred that reflected XSS can be triggered from arbitrary URLs, allowing an attacker with only network access to send a crafted link to a target user; the absence of authentication or restrictive input handling means anyone who visits the malformed URL may be affected.