The Live Dashboard plugin for WordPress suffers from a Reflected Cross‑Site Scripting flaw. Improper neutralization of input permits attackers to inject arbitrary JavaScript when a victim visits a specially crafted URL. This can lead to theft of session cookies, unauthorized actions performed on behalf of the user, and defacement of the page.

The vulnerability affects any installation of the Mike Martel Live Dashboard plugin with a version number of 0.3.3 or earlier. No other product versions are impacted.

With a CVSS base score of 7.1 the flaw is considered high severity. The exploitation probability is very low (EPSS < 1 %) and it is not listed in the CISA KEV catalog. Attacking requires an active user to click a malicious link, so it is a user‑interaction XSS, but once triggered it can compromise confidentiality and integrity of the victim’s session. The risk is therefore a moderate‑to‑high threat for environments that expose the plugin’s URLs to external users.