The vulnerability is a reflected Cross‑Site Scripting flaw caused by improper neutralization of input in the Catch Duplicate Switcher WordPress plugin. When an attacker crafts a malicious URL that includes malicious script content, the plugin echoes that input back into the browser, allowing the script to run in the context of users who visit the link. This can lead to credential theft, cookie theft, or other malicious actions executed by the victim’s browser.

The plugin "Catch Duplicate Switcher" from Catch Themes is affected for all versions from the earliest available through version 2.0. Users who have not upgraded beyond 2.0 are at risk.

The CVSS score of 7.1 indicates a high severity, and the EPSS score of less than 1% shows a low but non‑zero chance of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a crafted HTTP request to the WordPress site that includes malicious query parameters or form data, which are reflected back and executed by the visitor’s browser.