The vulnerability is an improper neutralization of input during web page generation, allowing a reflected cross‑site scripting flaw in the Vendor Vampire Character Manager plugin. An attacker can embed script code in a crafted request, which the plugin outputs without encoding, enabling the execution of arbitrary JavaScript in a victim’s browser. The impact is code execution in the context of the site, compromising confidentiality, integrity, and authenticity for all users who view the affected page.

The flaw affects the WordPress plugin Vampire Character Manager, version 2.13 and earlier. It is distributed by the vendor magent and installs via the WordPress plugin system. No other WordPress core components are directly affected.

The CVSS score of 7.1 indicates a high‑severity risk. The EPSS score of < 1% signals a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an unauthenticated user or any user who can craft a URL that is processed by the plugin. An attacker could exploit the flaw by visiting a crafted link that contains a malicious script payload, which would then run in the victim’s browser when the page is rendered.