The vulnerability is an improper neutralization of input during web page generation, allowing an attacker to inject malicious script into a page that is served to unsuspecting users. This can lead to theft of session cookies, defacement or redirection, and execution of arbitrary code in the victim’s browser. The weakness is a classic reflected XSS flaw, identified as CWE‑79.

The affected vendor is Rakessh, specifically the Ads24 Lite WordPress plugin through version 1.0 inclusive. WordPress installations that have this plugin loaded and a user visits a page that passes unsanitized parameters to the plugin will be vulnerable.

The CVSS score of 7.1 indicates a high risk, but the EPSS score of less than 1 % shows a very low probability of exploitation at present and the vulnerability is not in the CISA KEV catalog. Likely exploitation would involve an attacker embedding a malicious script into a link that a user clicks, triggering the reflected XSS and compromising the victim’s browser. The attack could be carried out remotely without authentication, provided the site’s URL or an admin access page is publicly reachable.