CodeBard Help Desk plugin contains a reflected XSS flaw caused by failure to properly sanitize user input before rendering. The vulnerability allows an attacker to inject malicious scripts into pages that the plugin generates, potentially executing in the browsers of authenticated or unauthenticated visitors. The impact can include defacement, cookie theft, session hijacking, and further compromise of the WordPress site.

Vulnerable systems are WordPress installations that have the CodeBard Help Desk plugin installed at version 1.1.2 or earlier. The issue affects all revisions from the initial release through 1.1.2. Site administrators using the plugin should verify the version in use and plan for remediation.

The CVSS score of 7.1 indicates a high severity flaw. The EPSS score of less than 1% suggests a very low probability of widespread exploitation at this time. The vulnerability is not currently listed in the CISA KEV catalog. However, the attack can be carried out remotely by directing a victim to a crafted URL that includes the malicious payload, which is then reflected in a page rendered by the plugin. Once the payload executes, it runs with the privileges of the browsing user, allowing an attacker to steal credentials or manipulate the content presented to other users.