The Blrt WP Embed plugin contains an improper neutralization of input vulnerability that allows reflected cross‑site scripting. User supplied data is incorporated into web pages without sufficient escaping, letting an attacker inject and execute arbitrary JavaScript in the context of victim browsers. This can compromise confidentiality, integrity, and availability for users who view the affected pages.

WordPress installations that have the Blrt WP Embed plugin installed with a version equal to or older than 1.6.9. The vendor is Blrt and the affected product is the Blrt WP Embed plugin.

The CVSS v3 score of 7.1 classifies this as a high‑severity vulnerability, and the EPSS score of less than 1% indicates a low probability of exploitation at the present time. It is not listed in the CISA KEV catalog, which reduces the likelihood of widespread, targeted exploitation. Based on the description, it is inferred that an attacker could craft a URL or form containing malicious input that the plugin reflects in the browser, thereby delivering the XSS payload to any user who visits the affected page.