The Jet Skinner for BuddyPress plugin contains a flaw where user input is reflected back to the browser without proper sanitization, allowing an attacker to inject and execute arbitrary JavaScript code in the victim’s session. This reflected XSS weakness (CWE‑79) can enable session hijacking, credential theft, or web page defacement while the user interacts with the vulnerable site. The impact is restricted to the individual who accesses a malicious URL or form and does not provide a direct path to system compromise.

WordPress installations that have the milordk Jet Skinner for BuddyPress plugin version 1.2.5 or earlier are affected. Any site running the plugin within this version range is potentially vulnerable; no further build or configuration details are supplied.

The CVSS score of 7.1 indicates a high severity risk, but the EPSS rating of less than 1 % suggests that exploit attempts are rare at present, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is the delivery of a crafted URL or form payload that includes malicious script content, inferred from the description of the reflected XSS issue. Proper sanitization of user input or the availability of an updated plugin would mitigate this risk.