The vulnerability is an improper neutralization of user input during web page generation, classified as CWE‑79. An attacker can inject malicious JavaScript that will be reflected in the browser context of the victim when they visit a crafted URL. This allows the execution of arbitrary client‑side script, leading to cookie theft, session hijacking, defacement, or redirection, thereby compromising the confidentiality and integrity of the website and its users.

The flaw exists in the adamskaat Scroll Top plugin for WordPress, specifically in all releases up to and including version 1.3.3. Systems using these versions are vulnerable until updated to a patched release.

The CVSS score of 7.1 places the issue in the high‑severity range. However, the EPSS score of less than 1 % indicates that observable exploitation actions are currently rare. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The attack path is likely via a crafted link or form that includes reflected data, making it easily exploitable by a threat actor with internet access targeting sites that host the affected plugin.