The Accessibility Task Manager plugin up to version 1.2.1 fails to escape user input before rendering it into a web page, creating a reflected XSS flaw under CWE‑79. When an attacker supplies malicious data that is subsequently reflected in the page, arbitrary JavaScript may run in the victim’s browser, enabling session hijacking, defacement, or the execution of further harmful actions.

Any WordPress site that installs the pshikli Accessibility Task Manager plugin at version 1.2.1 or earlier is vulnerable. Sites that use the plugin at a later version or omit the plugin altogether are not affected.

The CVSS score of 7.1 denotes high severity, while the EPSS score of less than 1 % indicates that exploitation is currently uncommon. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector involves an attacker crafting a URL or form payload that reaches the plugin’s vulnerable output route, allowing the malicious input to be reflected back to any visitor or logged‑in user. Exploitation does not require privileged access beyond the ability to send the crafted request, so any user exposed to the vulnerable plugin’s pages remains at risk until the plugin is upgraded or removed.