The vulnerability is a reflected cross‑site scripting flaw that allows an attacker to inject arbitrary JavaScript into a page served by the Custom CSS Addons plugin. The injected code runs in the victim’s browser, potentially exfiltrating cookies, hijacking sessions, or defacing the site. This flaw is classified as CWE‑79 and can be particularly dangerous for visitors who authenticate or interact with sensitive content on the website.

Bastien Ho Custom CSS Addons for WordPress, versions up to and including 1.9.1 (the starting version is not specified in the CVE), are affected. Any site running the plugin at version 1.9.1 or earlier is vulnerable.

The CVSS score of 7.1 reflects a moderate to high risk, while the EPSS score of less than 1% indicates a low probability of observed exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred from the plugin’s handling of user‑supplied input, such as settings fields or query parameters, which the plugin does not sanitize. An attacker could craft a malicious URL or form submission that, when viewed by a user, executes the injected script.