The vulnerability is a classic Cross‑Site Scripting flaw caused by improper neutralization of user input during web page generation. Malicious actors can embed JavaScript in a crafted URL or form field that the plugin reflects back to the browser, allowing the execution of arbitrary scripts in the victim’s context. This can be used for session hijacking, cookie theft, or defacement. The weakness is classified as CWE‑79.

The WordPress Heartland Management Terminal plugin from SecureSubmit is affected for all releases from the initial version up to and including version 1.3.0. Any WordPress site that has this plugin installed and running a vulnerable version is susceptible.

With a CVSS score of 7.1 the flaw is considered medium‑high severity. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is remote, via a crafted URL or input field that the plugin reflects. An attacker only needs to convince a user to visit a malicious link or submit a form to trigger the XSS payload.