The Dezdy plugin for WordPress contains an improper neutralization of input during web page generation that permits reflected cross‑site scripting. An attacker can inject malicious script into the browser of any user who visits a crafted URL or form handled by the plugin. The vulnerability enables the attacker to steal session cookies, deface the site, or redirect users, compromising both confidentiality and integrity of user data.

Vendors affected are Dezdy.com, specifically the Dezdy WordPress plugin version 1.0 and earlier. Any WordPress installation that has the Dezdy plugin (dezdy‑mcommerce) installed with a version number <= 1.0 is vulnerable. No other versions are listed.

The CVSS score of 7.1 classifies it as high severity. The EPSS score is less than 1 %, indicating a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attack vector is remote, via a reflected XSS payload that does not require authentication. The exploit requires the victim to load a page or click a link processed by the plugin, making social engineering a likely prerequisite.