The vulnerability is an improper neutralization of input that allows an attacker to inject malicious script into an HTTP response. When a crafted request is made, the plugin echoes the attacker‑supplied data without adequate encoding, enabling execution of arbitrary JavaScript in the context of any user who views the affected page. This can lead to theft of session cookies, defacement of the site, or‑consensual actions on behalf of the user. The weakness corresponds to CWE‑79, reflecting a classic reflected XSS flaw.

Vikash Srivastava’s VSTEMPLATE Creator WordPress plugin is affected. All releases from the product’s earliest version up to and including 2.0.2 are vulnerable. Any WordPress installation that has this plugin installed and enabled is at risk.

The CVSS score of 7.1 places the flaw in the moderate‑to‑high severity range. The EPSS score of less than 1% indicates a low probability of exploitation currently, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a Remote user sending a specifically crafted URL or embedding a malicious link. A victim who opens the link will be exposed to the injected script, making the flaw exploitable from a web browser context without any additional authentication.