The HyperComments plugin contains an Improper Neutralization of Input During Web Page Generation flaw that allows attackers to inject arbitrary client‑side script into a page viewed by a victim. This reflected cross‑site scripting vulnerability (CWE‑79) can enable script execution in the victim’s browser, leading to session hijacking, phishing, defacement, or other malicious code execution.

SiteHeart’s HyperComments WordPress plugin, versions up to and including 0.9.6, are affected. Any WordPress site using this plugin version is at risk, regardless of site size or user base.

With a CVSS score of 7.1 the vulnerability is considered high severity, and the EPSS score of less than 1 % suggests a low exploitation probability at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers can deliver the payload via a crafted URL or form input that the plugin reflects back in the generated page, so the likelihood of exploitation depends on the presence of publicly exposed entry points that accept unsanitized input.