Improper neutralization of input during web page generation results in a reflected XSS vulnerability within the ‘azurecurve Floating Featured Image’ WordPress plugin. The flaw allows an attacker to inject arbitrary JavaScript into the output of a page that the victim subsequently requests. Successful exploitation can lead to theft of user session cookies, defacement or the execution of code in the victim’s browser, thereby compromising the confidentiality, integrity and availability of the site.

WordPress sites that have the ‘azurecurve Floating Featured Image’ plugin installed and enabled, from the plugin’s initial release through version 2.2.0, are affected by this vulnerability.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of <1% suggests that exploitation is unlikely but still possible. The vulnerability is not listed in CISA KEV. Attackers can exploit the flaw by crafting a URL or form input that is reflected in the plugin’s output, requiring the victim to visit the malicious link or submit the input. Because the vulnerability is client‑side, it only impacts users who interact with the affected page.