The Tidy.ro plugin for WordPress fails to properly neutralize user‑supplied input when rendering web pages, allowing a malicious script to be injected into the page that the requesting user views. This reflected XSS flaw lets an attacker deliver and execute arbitrary JavaScript in the victim’s browser, potentially stealing session cookies, manipulating the page content, or redirecting the user to phishing sites.

Any WordPress installation that includes the Tidy.ro plugin version 1.3 or earlier is vulnerable. The issue applies to all releases from the first available version up through 1.3. "Affected Systems": All WordPress sites running Tidy.ro <= 1.3 regardless of active themes or other plugins.

The CVSS score of 7.1 places this flaw in the high severity range. The EPSS score of less than 1% indicates that exploitation is expected to be uncommon at the time of assessment, and the vulnerability is not listed in CISA’s KEV catalogue. The likely attack vector is client‑side, where an attacker can craft a malicious link containing the vulnerable input and entice a user to click it. No privileged access or server‑side code execution is required, but the risk remains significant for users who may interact with such links.