Improper neutralization of user input during web page generation in the WP‑Announcements plugin allows reflected cross‑site scripting. The vulnerability is a classic input‑validation flaw (CWE‑79) that can enable attackers to inject arbitrary script into a page viewed by other users, potentially leading to session hijacking, data theft, or defacement.

The vulnerability affects the WordPress plugin WP‑Announcements from the vendor Brian Messenlehner, for all releases up to and including version 1.8. Users running any versions 1.8 or earlier are impacted, regardless of the WordPress core version.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% denotes a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. It is likely exploitable via a crafted URL that, when visited by an authenticated or unauthenticated user, reflects malicious script back into the page. The requirement for user interaction and unprivileged access makes this a moderate‑to‑high risk scenario, warranting prompt remediation.