An input validation flaw in the WordPress Ps Ads Pro plugin allows reflected cross‑site scripting. The flaw occurs when user‑supplied data is incorporated into the web page without proper sanitization, enabling an attacker to inject malicious scripts that run in the victim’s browser. This could lead to session hijacking, defacement, or theft of user credentials for the compromised site.

The vulnerability affects all installations of the Ps Ads Pro plugin from the earliest version through version 1.0.0. The plugin is distributed by Padam Shankhadev and is used on WordPress sites that have not upgraded beyond the listed maximum version.

The CVSS score is 7.1, indicating a high severity vulnerability. The EPSS score of less than 1% shows that the probability of exploitation is low but not negligible; the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to drive a user to a crafted URL that contains malicious input; the script then executes in the context of the website, potentially affecting any users who view the vulnerable page. The attack vector is inferred as web‑based, and exploitation does not require any special privileges beyond access to the affected WordPress site.