The vulnerability is due to improper neutralization of input during web page generation, allowing reflected XSS. A malicious user can embed JavaScript or other code in a URL that the plugin echoes unescaped, which is then executed in a victim’s browser when that URL is visited.

Michael Stursberg’s Browser‑Update‑Notify plugin for WordPress is affected. All installations running version 0.2.1 or earlier are vulnerable; no later versions are listed as impacted.

The CVSS score of 7.1 indicates a high severity. The EPSS score of less than 1 % suggests that exploitation is currently uncommon. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker could create a malicious link that contains the payload and encourage a user to click on it. The vulnerability requires the victim’s browser to execute the injected script, provided that no defenses such as a content‑security policy or server‑side sanitization are in place.