The flaw is an improper neutralization of input during web page generation that allows a reflected cross‑site scripting (XSS) attack. Attackers can supply malicious code that is echoed back in the user’s browser, potentially enabling session hijacking, defacement, or cookie theft when a victim clicks a crafted link. This weakness matches CWE‑79.

The vulnerability affects the WordPress Frontend Post Submission plugin by Umesh Ghimire, any release from the earliest available version through version 1.0. Authenticated or unauthenticated users that submit content via the frontend form are exposed unless the plugin is updated beyond 1.0.

The CVSS score of 7.1 places this in the high severity range. With an EPSS score of less than 1 %, the likelihood of exploitation is considered low at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves a victim receiving a link that contains the malicious payload, an inference based on the nature of reflected XSS. No authentication or elevated privileges are required for exploitation.