The WP Headmaster plugin for WordPress contains a reflected cross‑site scripting flaw due to improper neutralization of user input during page generation. The vulnerability is marked CWE‑79. An attacker can embed malicious scripts in input that the plugin outputs unfiltered, allowing code execution in the browser of users who view the vulnerable page.

WordPress installations that have the WP Headmaster plugin from bavington installed at version 0.3 or earlier. The vulnerability applies to all WordPress sites that have this plugin enabled. No additional version details are provided in the CNA data beyond the inclusive range up to 0.3.

The CVSS score of 7.1 indicates a high severity reflected XSS flaw that can be triggered through a crafted URL or input field. The EPSS score of < 1 % suggests a very low but non‑zero probability of exploitation; it is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could supply malicious input that is reflected by the plugin, potentially enabling script execution in users’ browsers. The likely attack vector is remote, through the web interface, but the exact impact on confidentiality, integrity or availability depends on the victim’s privileges and the nature of the injected script.