The vulnerability in the Track Page Scroll WordPress plugin allows an attacker to inject malicious script into a page that is then reflected back to the victim. The improper neutralization of input during page generation means that crafted input is executed by browsers when the page loads, leading to cookie theft, session hijacking, or website defacement. This type of flaw can be exploited through crafted URLs or form fields and directly compromises confidentiality and integrity of user sessions.

The affected product is the WordPress plugin Track Page Scroll, authored by mndpsingh287, versions up to and including 1.0.2. Any installation using these versions is vulnerable until updated.

The CVSS score of 7.1 indicates a high severity, and the EPSS score of less than 1% suggests that the exploitation probability is currently low, consistent with no listing in the CISA KEV catalog. The likely attack vector involves redirecting a user to a malicious link that includes crafted parameters handled by the plugin. Once a user visits the link, the reflected script runs in the victim’s browser, enabling an attacker to compromise that session or deface the site.