Improper neutralization of input in the Translation.Pro plugin allows an attacker to embed malicious script that is reflected directly into the page output. This vulnerability is a classic reflected XSS flaw where arbitrary JavaScript can execute in the context of a victim’s browser, potentially enabling session hijacking, credential theft, or defacement. The weakness is a failure to sanitize or encode request input, identified as CWE‑79.

The affected product is the WordPress plugin Translation.Pro from ContentLocalized. Versions from the initial release up through 1.0.0 are vulnerable.

The CVSS score of 7.1 indicates a high potential for exploitation, while the EPSS score of less than 1% suggests it is currently unlikely to see widespread attacks. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability can be triggered by sending a specially crafted request to a site that uses the plugin. Based on the description, it is inferred that this may be exploitable without authentication, though this is not explicitly documented.