The vulnerability is an improper neutralization of input during page generation within the WP Post Corrector plugin. An attacker can inject malicious JavaScript into reflected parameters, causing the script to run in the victim’s browser. This can lead to cookie theft, session hijacking, defacement or unintended navigation, compromising the confidentiality and integrity of user data that is displayed on the site.

The plugin is identified as WP Post Corrector, authored by vipul Jariwala. The flaw exists in versions from the earliest available release up to and including version 1.0.2. WordPress sites that have installed any of those vulnerable plugin versions are at risk, regardless of site configuration or user role.

The CVSS score of 7.1 indicates moderate to high severity. The EPSS score of less than 1% suggests a relatively low yet non-zero probability of exploitation in the wild. It is not currently listed in CISA KEV. The likely attack vector is a reflected XSS through blog post or content fields that echo user-supplied data without proper sanitization, and an attacker must attract a victim browser to the crafted URL to succeed. Because the flaw lies in client‑side rendering, active exploitation requires user interaction, but once triggered it can execute arbitrary scripts.