The Google Transliteration plugin contains an improper neutralization of input during web page generation that allows reflected cross‑site scripting. An attacker can inject malicious script into a URL or form input that the plugin includes unfiltered in the page output. If executed in a user’s browser, the script can steal session cookies, perform actions on behalf of the user, or redirect the user to phishing sites.

WordPress sites that use the moallemi Google Transliteration plugin with version numbers through 1.7.2 are affected. The vulnerability exists in all releases from the first version up to and including 1.7.2.

The CVSS score of 7.1 denotes a medium‑to‑high risk. The EPSS score of less than 1 % indicates that exploitation is considered very unlikely at present, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a publicly reachable input point, such as a URL parameter or form field processed by the plugin. An attacker would need to craft malicious input and lure a victim to the infected page; no elevated privileges or authentication are required.