Md Imranur Rahman LocalGrid plugin contains an improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute in the browsers of site visitors. This reflected XSS flaw means that a crafted request can embed arbitrary JavaScript, potentially leading to defacement, credential theft, or drive‑by malware infections for anyone who follows a vulnerable link or accesses a tampered form. The vulnerability is a classic CWE‑79 weakness where input is reflected without sufficient validation or output encoding.

WordPress sites that have installed the LocalGrid plugin, with any version up to and including 1.0.1. No specific versions beyond 1.0.1 are listed as affected, and newer releases are presumed to have applied the fix.

The CVSS score is 7.1, indicating a high severity. The EPSS score of less than 1% shows that, although possible, the likelihood of exploitation in the wild is currently low. The vulnerability is not listed in the CISA KEV catalog. Attacks would require a user to visit a maliciously crafted URL or interact with a manipulated form, so the vector is primarily local web input provided to the target WordPress site. With the flaw being a reflected XSS, any visitor to the site could be affected if they open the crafted payload.