Improper neutralization of input during web page generation allows reflected XSS via the TinyMCE Extended Config WordPress plugin. This weakness (CWE‑79) permits an attacker to inject and execute arbitrary JavaScript in a visitor’s browser, enabling defacement, cookie theft, session hijacking, or execution of other malicious actions in the context of the site.

The vulnerability affects the willshouse TinyMCE Extended Config plugin for WordPress. Versions from the earliest release up to and including 0.1.0 are vulnerable. No patched versions are noted in the supplied data.

The CVSS score of 7.1 indicates a medium‑to‑high severity issue, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw through user‑controllable input fields that the plugin reflects back in the generated page. If the plugin is accessible to unauthenticated users, the risk extends to all visitors; if only administrators can use the plugin, the scope is limited to the site-backend environment. Given the nature of XSS attacks, the compromise could be both immediate and persistent, depending on how the vulnerability is leveraged.