The vulnerability is a reflected Cross‑Site Scripting flaw caused by improper neutralization of user supplied input during page generation in the 4‑author‑cheer‑up‑donate plugin. An attacker can supply malicious data that the plugin echoes back in a response page, allowing execution of arbitrary JavaScript in the victim's browser. This can lead to cookie theft, session hijacking, defacement or other malicious actions, as detailed by CWE‑79.

The issue affects the WordPress plugin 4‑author‑cheer‑up‑donate developed by montashov, in all released versions from the beginning of the series up to and including version 1.3.

The CVSS score of 7.1 indicates a moderate to high severity. The EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is currently very low, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the typical attack vector involves a crafted URL or form input that the plugin reflects, and any website that uses the vulnerable plugin is at risk if users visit such a request.