The vulnerability is an improper neutralization of input during web page generation that allows a reflected XSS flaw. An attacker can embed malicious JavaScript into a response that echoes user data, and the script will run in the context of any user who visits the crafted URL. This is a classic CWE‑79 weakness and can compromise the confidentiality and integrity of user data, including session hijacking and data theft.

The affected product is the WordPress plugin Page Health‑O‑Meter from the vendor brainpulse. All releases from the first version through 2.0 are vulnerable, so any site running the plugin in this version range must be verified and upgraded if necessary.

The CVSS score of 7.1 signals a high‑risk vulnerability, and the EPSS score of less than 1% indicates a presently low probability of exploitation. Based on the description, it is inferred that the likely attack vector requires an attacker to entice a user to visit a crafted URL or submit a malicious form containing the payload. While the flaw is not listed in the CISA KEV catalog, its presence in a widely‑used WordPress plugin raises concern if an exploit surface is misused.