An improper neutralization of input during web page generation in the thobian Network‑Favorites plugin permits reflected cross‑site scripting. By injecting malicious script into reflected data, an attacker can execute arbitrary JavaScript in the context of a victim’s browser, potentially leading to credential theft, defacement, or further compromise of the site. The weakness is classified as CWE‑79.

The vulnerability applies to the thobian Network‑Favorites WordPress plugin version 1.1 and earlier. Any site running one of these versions is affected.

The CVSS v3.1 score of 7.1 indicates a high severity, while the EPSS score of less than 1% suggests very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector involves an attacker crafting a URL or form input that includes malicious script, which the plugin reflects unescaped in a page response, enabling execution in the victim’s browser.