The WP‑Asambleas plugin suffers from an Improper Neutralization of Input During Web Page Generation flaw, known as Cross‑Site Scripting. An attacker can supply crafted input that is reflected in the browser without proper encoding, enabling the execution of malicious JavaScript in the context of the authenticated user. This weakness is classified as CWE‑79 and compromises the confidentiality and integrity of the data processed on the site, potentially leading to session hijacking or defacement if the victim is an administrator.

All installations of the WP‑Asambleas plugin released by platcom, from its earliest version through version 2.85.0, are affected. Users of any version equal to or lower than 2.85.0 should treat the product as vulnerable.

The CVSS score of 7.1 indicates a high impact with medium to high exploitation complexity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Because the flaw operates through reflected input, the likely attack vector is a user‑initiated request or a malicious link sent to a target, which is then executed in the target’s browser. No additional conditions are disclosed in the advisory, so a simple crafted URL or form submission can trigger the payload.