The HM Portfolio plugin for WordPress contains an improper neutralization of input during web‑page generation that allows reflected cross‑site scripting. Attackers can embed malicious scripts in parameters of URLs that the plugin outputs unescaped, enabling arbitrary script execution in the browsers of visitors to the site. Because the flaw is a classic reflected XSS (CWE‑79), it can lead to information theft, defacement, or credential compromise if users accept the injected code.

The vulnerability affects the HM Portfolio plugin developed by Matthew Haines‑Young for WordPress, specifically all releases through version 1.1.1. Sites using any of these versions are susceptible as the plugin does not properly escape user‑supplied input before rendering it in the page.

The CVSS score of 7.1 indicates a medium‑to‑high severity, while the EPSS score of less than 1% shows that the exploitation probability is low. No listing in the CISA KEV catalog suggests that it is currently not a known exploited vulnerability. The most likely attack vector involves a crafted URL delivered to unsuspecting visitors; once the victim clicks it, the injected script runs in their browser without requiring additional privileges or authentication.