This vulnerability results from improper neutralization of user input during web page generation, enabling attackers to inject malicious JavaScript into pages served to visitors. A reflected XSS flaw allows harmful scripts to run in the victim’s browser, potentially leading to session hijacking, cookie theft, credential compromise, or site defacement.

The flaw affects the WordPress Tab My Content plugin from patrice, versions up to and including 1.0.0. Administrators should verify that any sites running Tab My Content at version 1.0.0 or earlier are addressed.

The CVSS score of 7.1 indicates a high‑severity vulnerability that can be triggered without authentication. The EPSS score of less than 1% suggests a low probability of exploitation at present, and it is not listed in the CISA KEV catalog. Attacks are likely to be delivered via crafted URLs that submit unsanitized input to the plugin, making the incident possible from remote attackers using web browsers.