The vulnerability is caused by improper neutralization of user input when the plugin generates a page, allowing an attacker to inject JavaScript that is reflected back to the user’s browser. A malicious link or form containing script code can be executed in the victim’s session, potentially leading to session hijacking, credential theft, or defacement of the site. The flaw does not provide server‑side execution but poses a significant threat to confidentiality, integrity, and availability of the web application and its visitors.

WordPress sites that have the Alessandro Benoit WpDevTool plugin installed with a version of 0.1.1 or earlier are impacted.

The CVSS score of 7.1 classifies this as high severity, while the EPSS score of less than 1% shows exploit activity is currently low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a web‑based attack vector and an end‑user interaction with a crafted page. Given the high CVSS, proactive patching is recommended to mitigate potential exploitation.