The vulnerability is an improper neutralization of input during web page generation, allowing an attacker to inject arbitrary scripts into pages that are served to users. This reflected XSS flaw arises in the fxy060608 新淘客WordPress插件 (wp‑xintaoke) when it processes unsanitized query parameters. An attacker can trigger the vulnerability by crafting a URL that contains malicious payloads, which the plugin then echoes back into the page. Because the script runs in the victim's browser, an attacker could steal session cookies, perform phishing, or load additional malicious content on the site.

Affected systems consist of the fxy060608 新淘客WordPress插件 WordPress plugin, versions from the initial release through <= 1.1.2. Any WordPress installation that has this plugin enabled and is running one of those versions is vulnerable.

The CVSS score of 7.1 indicates a medium-to-high impact. The EPSS score of < 1% suggests currently low likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalogue, implying no confirmed or widely known active exploits. The likely attack vector is an attacker hosting a crafted URL or embedding malicious links on third‑party sites, targeting users who click and load the reflected content within the vulnerable plugin.