The vulnerability is an improper neutralization of input during web page generation (CWE‑79) that allows a reflected cross‑site scripting flaw in the WordPress plugin "ChatGPT Open AI Images & Content for WooCommerce". This flaw can be used to execute arbitrary JavaScript in the context of the visitor’s browser, facilitating phishing, cookie theft, or defacement. The flaw arises when the plugin echoes user‑controlled data without adequate escaping.

The affected product is the ChatGPT Open AI Images & Content for WooCommerce plugin by Mauricio Urrego, all releases from the earliest available version through 2.2.0. Any site that has installed a version up to 2.2.0 is vulnerable.

The CVSS score of 7.1 indicates high impact and medium attack complexity. The EPSS score of <1% implies a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can deliver malicious content via crafted web requests or URLs that trigger the vulnerable plugin, reflecting the payload back to unsuspecting users. The same flaw could be monetized through credential theft or malicious redirects if actively exploited.