The vulnerability arises from improper neutralization of input during web page generation, allowing reflected XSS. An attacker can embed malicious script into a URL parameter supplied by the Goo.gl Url Shorter plugin, which is then reflected back in the generated page without proper sanitization. When an end‑user views the page, the injected script runs in the user's browser, potentially compromising user credentials, executing additional malicious actions, or modifying the page content.

WordPress sites that have installed the CantonBolo Goo.gl Url Shorter plugin version 1.0.1 or earlier are affected. This applies to any deployment of the plugin on any WordPress installation that has not been updated beyond the specified version.

The CVSS score of 7.1 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting a URL that triggers the plugin’s reflected response, allowing arbitrary script injection into the victim’s browser session. This risk is mitigated only by updating the plugin or removing the attack surface.