The WP FixTag plugin contains an improper neutralization of input during web page generation that results in all parameters reflected without sanitization. This flaw can be abused to inject arbitrary script payloads, which are executed in the context of any user who views the affected page. The impact is code execution within the victim’s browser, enabling session hijacking, credential theft, or defacement.

WordPress installations that have the WP FixTag plugin version 2.0.2 or older are vulnerable. The plugin is developed by Mohsen Shahbazi and is commonly found in sites that rely on it for tag management or related functionalities.

The vulnerability scores a CVSS of 7.1, indicating a moderate to high severity. The EPSS score is less than 1%, suggesting a relatively low probability that an attacker has identified or deployed an active exploit. The issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a crafted HTTP request that includes malicious script content in plugin parameters; the attacker does not need authentication and can target any exposed endpoint that processes the input.