The vulnerability stems from an improper neutralization of user input during web page generation, allowing an attacker to inject malicious scripts that are reflected back to the victim’s browser. This flaw can lead to the execution of arbitrary client‑side code, which may enable session hijacking, defacement of content, or silent data exfiltration, depending on the context in which the script runs.

The issue affects the WordPress StatPressCN plugin developed by heart5, specifically all releases from its inception through version 1.9.1.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% shows a low likelihood of exploitation at the time of this analysis, and it is not listed in the CISA KEV catalog. The most probable attack vector is a remote user supplying a crafted query string or form field that is reflected without proper sanitization, leading to the execution of malicious JavaScript in the victim’s browser.