The Simple Custom post type custom field plugin accepts arbitrary input for custom fields and reflects that input directly into generated web pages without neutralization, creating a reflected cross‑site scripting flaw (CWE‑79). An attacker can embed malicious script code that will execute in the browsers of users who view the affected content.

The vulnerability impacts the WordPress plugin faaiq Simple Custom post type custom field, affecting all releases from the initial release up to and including 1.0.3. Any WordPress site that has installed or is currently using this plugin within that version range is susceptible.

The CVSS score of 7.1 indicates moderate to high severity. An EPSS score of <1 % indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred from the fact that this is a reflected XSS flaw; it is likely that an attacker would need to entice a victim to visit a crafted URL or click a malicious link, after which the injected script executes in the victim’s browser context and can compromise their session or any data exposed by the site.