This vulnerability is an Improper Neutralization of Input During Web Page Generation flaw that allows reflected XSS. A malicious user can embed script code in crafted request parameters that Tagesteller fails to sanitize, leading to the execution of arbitrary JavaScript in the browser of anyone who views the affected page. The impact is the compromise of the confidentiality, integrity, or availability of the user session, as well as potential credential theft or website defacement. The weakness is classified as CWE‑79.

The affected product is the WordPress Tagesteller plugin from vendor Helle1. All installs from the first release through version 1.1 are vulnerable. No other versions are listed as affected.

The CVSS score of 7.1 indicates a high severity for an unauthenticated user. The EPSS score of <1% reflects a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely a reflected XSS, where a crafted URL or form input containing malicious script reaches the client browser, with no authentication required. The fact that the flaw exists in a widely used WordPress plugin means that a broad range of sites could be exposed if the plugin is unchanged.