The flaw is an improper neutralization of input during web page generation (CWE‑79). A user‑supplied parameter is inserted into the page without adequate sanitization, allowing an attacker to inject JavaScript. When a crafted link is clicked, the malicious script runs in the victim’s browser, potentially enabling session hijacking, defacement, or delivery of further malicious content.

The vulnerability exists in the REDIRECTION PLUS plugin for WordPress, supplied by the vendor tahminajannat. Versions from the initial release through 2.0.0 are affected. Any WordPress site that has the plugin installed and is running a version in that range is susceptible.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% shows a low but non‑zero exploitation probability. The flaw is not listed in the CISA KEV catalog, but attackers can exploit it remotely by embedding malicious payloads in the plugin’s redirection parameters. The attack requires the victim to click a crafted link, so the vulnerability is a reflected XSS that relies on user interaction.