Improper neutralization of user‑supplied input during web page generation allows reflected XSS in the WP Post Category Notifications plugin. When an attacker constructs a URL with malicious script payloads, the plugin echoes the input directly into the page without sanitization, resulting in arbitrary JavaScript execution in the victim’s browser. This vulnerability can facilitate session hijacking, cookie theft, unauthorized content injection, or defacement. The weakness is a classic input validation flaw (CWE‑79).

The vulnerability affects the WordPress plugin WP Post Category Notifications, version 1.0 and earlier. No other affected products are listed.

The CVSS score of 7.1 categorizes this issue as High severity. The EPSS score of less than 1 % indicates a very low but non‑zero probability of exploitation. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is inferred to be reflected via crafted URLs; the prerequisite is a publicly accessible WordPress site with the vulnerable plugin enabled. An attacker can target any visitor who clicks a malicious link containing the exploitable query or path parameters. The impact is local to the victim’s browser but can lead to broader compromise if credentials are stolen.