The vulnerability is an improper neutralization of input during web page generation, identified as a reflected XSS flaw. An attacker can embed malicious scripts in a URL that, when accessed by a victim, will execute in the victim’s browser. This may lead to session hijacking, credential theft, defacement, or other malicious activity, affecting the confidentiality and integrity of user data. The weakness is rooted in CWE‑79.

The affected product is the GoodLayers Goodlayers Blocks plugin for WordPress. The flaw exists in all released versions from the initial release through 1.0.1 inclusive. Users running any of those versions should be considered vulnerable.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time. The flaw is not yet listed in the CISA KEV catalog. Because the vulnerability is reflected, an attacker most likely needs to trick a user into visiting a crafted URL or link, which requires social engineering or exploitation of user trust. Once triggered, the script runs with the victim’s privileges, enabling the attacker to perform client‑side attacks. The risk is mitigated by the plugin updated or by blocking untrusted input.