Improper neutralization of user input in the WP FPO plugin allows an attacker to inject and execute malicious scripts in the browsers of site visitors. The reflected nature of the flaw means the attacker’s payload is included in the server response when a crafted request is made. Successful exploitation can lead to session hijacking, theft of credentials, or the delivery of phishing content, all of which compromise user confidentiality and integrity. The weakness is identified as CWE‑79.

The vulnerability affects the husani WP FPO WordPress plugin with versions up to and including 1.0, regardless of the original release date. Any WordPress site that has installed this plugin in the specified version range is potentially vulnerable.

The CVSS score of 7.1 indicates a medium to high severity. However, the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, further indicating limited current exploitation activity. The most likely attack vector is through web requests that contain user input, such as query strings or form submissions, which the plugin fails to escape properly.