The plugin fails to properly neutralize user‑supplied data before embedding it into generated pages, allowing attackers to inject malicious scripts that are executed in the browser of anyone who views affected pages. This cross‑site scripting flaw can lead to credential theft, session hijacking, defacement or the execution of arbitrary JavaScript in the victim’s context, thereby compromising the confidentiality, integrity, and availability of the site’s users.

The weakness exists in the Rhizomaticweb RWS Enquiry And Lead Follow‑up WordPress plugin. Any WordPress installation running any version of the plugin from the initial release up to and including 1.0 is vulnerable. No other vendors or products are listed.

The CVSS score of 7.1 classifies the flaw as high severity. The EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation in the wild, and the vulnerability is not currently listed in CISA’s KEV catalog. Inferred from the description, the most likely attack vector is remote, whereby an attacker crafts a link or submits data that contains malicious code, which is then reflected back into the application’s output and executed in the victim’s browser.