An improper neutralization of user input during page generation allows a reflected cross‑site scripting (XSS) attack. The vulnerability can cause an attacker to inject malicious scripts into a web page that is displayed back to a victim, potentially stealing session data, defacing content, or redirecting users to phishing sites. The weakness is a classic input validation flaw, identified as CWE-79.

The described flaw affects the WordPress Explore pages plugin version 1.01 and all earlier releases. The plugin is developed by mbyte, titled "Explore pages." No additional vendor or product names are listed beyond that.

The CVSS score of 7.1 marks the issue as a high‑severity vulnerability. The EPSS score is reported as <1%, indicating a very low probability of exploitation in the wild at present. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation. Based on the description, the most likely attack vector is a user‑controllable URL parameter or form field that is reflected in a browser response. An attacker can trigger the XSS by sending a crafted link to a susceptible user, leading to client‑side script execution.