The vulnerability is an improper neutralization of input during page generation that results in reflected XSS. When a user follows a crafted URL containing malicious script, the script is executed in the victim’s browser. Based on the description, it is inferred that an attacker could use this to steal cookies, hijack sessions, deface the site, or deliver additional malware to the victim. The flaw is classified as CWE‑79 and allows an attacker to run arbitrary scripts with the victim’s privileges within the WordPress site.

WordPress installations that use the Mind3doM RyeBread Widgets plugin from the initial release up to and including version 1.0. Any user who loads a page that renders the widget is potentially affected.

The CVSS score of 7.1 indicates a high‑severity vulnerability. The EPSS score of less than 1% suggests that execution is unlikely at this time, and the flaw is not listed in CISA KEV, meaning no widespread public exploit is known. The likely attack vector is remote exploitation via a malicious URL that includes script content; no authentication is required, but the victim must click or visit the crafted link. The attacker can then execute arbitrary JavaScript in the victim’s browser context.