The vulnerability is improper neutralization of input during web page generation, exposing a reflected XSS flaw that conforms to CWE‑79. An attacker can embed arbitrary JavaScript into a page that is subsequently rendered to the victim, allowing session hijacking, phishing, or other client‑side attacks. The flaw arises because the plugin reflects unescaped user supplied data back to the browser.

Arash Safari’s QMean – WordPress Did You Mean plugin is impacted. Any WordPress site that has installed QMean version 2.0 or earlier is vulnerable. Versions released after 2.0 are not affected.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% implies a low exploitation probability at present. The vulnerability is not listed in CISA KEV. Exploitation requires an attacker to drive a victim to a crafted URL; the plugin’s input handling reflects the attacker’s data directly into the page without proper escaping. Consequently, the attack vector is remote via an untrusted web channel accessible to external users.