Improper neutralization of input during web page generation in the Easy Filtering plugin allows an attacker to inject arbitrary HTML or JavaScript that is reflected back to the user's browser. The flaw exists in all releases of the plugin up to and including version 2.5.0, due to the plugin’s failure to properly encode or sanitize user–supplied query parameters before rendering them.

The vulnerability affects franciscopalacios Easy Filtering installations on WordPress. All versions from the earliest available through 2.5.0 are vulnerable, so any WordPress site that has the plugin installed and has not upgraded beyond 2.5.0 is exposed.

The CVSS score of 7.1 indicates a moderate‑to‑high impact, while the EPSS score of less than 1% suggests current exploitation opportunities are scarce. The flaw is not listed in the CISA KEV catalog. The likely attack vector is a malicious URL or form containing the payload, inferred from the reflected XSS nature of the flaw; no authentication or special privileges are required. The overall risk is medium, but timely remediation is recommended.