WordPress Cobwebo URL Plugin does not properly neutralize user supplied input before rendering it in HTML, allowing an attacker to inject and execute JavaScript code in the victim’s browser. The injected script runs with the privileges of the current user and can hijack sessions, steal credentials, or deface the site. This flaw is classified as CWE‑79, representing an input validation weakness that directly leads to XSS.

The vulnerability exists in Cobwebo URL Plugin version 1.0 and all earlier releases, as identified by the plugin author editionskezzal. Any WordPress site that has this plugin installed and is running a vulnerable version is affected.

The CVSS v3 score of 7.1 indicates high severity, but the EPSS score of less than 1 % suggests that exploitation is currently unlikely. The flaw is not listed in the CISA KEV catalog. Attackers can exploit the vulnerability by tricking users into visiting a specially crafted URL that includes malicious JavaScript, which is then reflected back by the plugin’s output. The risk is mitigated by the need for the victim to interact with the site, but the impact on confidentiality, integrity, or availability can be significant if the attack succeeds.