Improper neutralization of input during web page generation activates a reflected XSS flaw in the WordPress vcOS plugin through version 1.4.0. The flaw allows an attacker to inject arbitrary JavaScript into the page that is rendered to the victim, potentially enabling cookie theft, session hijack, or defacement. The weakness is a classic input validation flaw identified as CWE‑79.

Any WordPress site that has the vcOS plugin – vendor jnwry – installed at version 1.4.0 or earlier. The vulnerability ranges from the initial release (n/a) up to and including 1.4.0 and affects every dependency path that exposes the plugin’s input fields through the web interface.

With a CVSS score of 7.1 the issue falls into the High severity band, yet the EPSS score is below 1 % indicating a very low chance of exploitation in the wild. The flaw is not listed in CISA KEV. Attackers can exploit it by crafting a URL that reflects user input back to the victim’s browser, typically via a link that the victim clicks or a social‑engineering campaign. Once executed, the injected script runs with the victim’s browser privileges, exposing significant confidentiality and integrity risks.