This vulnerability arises from improper neutralization of user input during web page generation in the CRUDLab Scroll to Top WordPress plugin, allowing reflected cross‑site scripting. When a user visits a crafted URL that contains malicious payload data, the script is executed in the victim’s browser within the site’s context, enabling an attacker to run arbitrary client‑side code.

All installations of the CRUDLab Scroll to Top plugin from the initial release through version 1.0.1 are affected. The plugin is distributed by CRUDLab and functions within any WordPress site; any user can trigger the flaw by supplying malicious input.

The CVSS base score of 7.1 indicates moderate to high severity. The EPSS score is below 1 %, suggesting a low current probability of exploitation, and the issue is not listed in the CISA KEV catalog. Reflective XSS can be triggered by unauthenticated users and may be used in phishing or social‑engineering attacks, making it potentially impactful even with a low exploitation probability.