The vulnerability is an Improper Neutralization of Input During Web Page Generation error, allowing a Reflected Cross‑Site Scripting (XSS) attack in the CantonBolo WordPress 淘宝客插件 taobaoke plugin. An attacker can inject malicious scripts that are reflected back to a victim’s browser if certain input parameters are not properly escaped. The impact is that an attacker can execute arbitrary JavaScript in the context of a site visitor, potentially leading to cookie theft, session hijacking, or defacement.

CantonBolo WordPress 淘宝客插件 taobaoke plugin, versions from unspecified starting point through 1.1.2 are affected. Users should verify that their installation is not at or below 1.1.2.

The CVSS score of 7.1 indicates a high impact, while an EPSS score of less than 1% shows that publicly known exploitation likelihood is currently low. The vulnerability is not listed in the CISA KEV catalog. Attackers would typically trigger the XSS by crafting a specially formed URL or form input that is processed by the plugin and reflected in the page response. No authentication or privileged access is required to exploit this reflected vulnerability.