Improper neutralization of user input allows reflected Cross‑Site Scripting, enabling an attacker to inject and execute arbitrary JavaScript in the context of a victim’s browser. By exploiting this flaw, an attacker could execute malicious scripts that steal authentication cookies, deface the site, or redirect users to phishing pages, compromising confidentiality and potentially leading to broader compromise of the WordPress installation.

webdeal's Podčlánková inzerce plugin for WordPress is affected. All releases from the earliest available version through version 2.4.0 are vulnerable. Sites using any of these versions are at risk.

The CVSS score of 7.1 highlights significant impact, while the EPSS score of less than 1% indicates that the likelihood of exploitation in the wild is currently low. The vulnerability is not listed in the CISA KEV catalog. The flaw is a reflected XSS, implying that the attack vector is a web‑based request, typically a crafted URL or form parameter that the plugin does not properly escape. An attacker who can lure a user to a maliciously constructed link on a WordPress site running the vulnerable plugin can inject script payloads that execute when the link is followed.