An input validation flaw in Clifton Griffin CGD Arrange Terms plugin lets attackers inject malicious scripts that are reflected back to the victim’s browser. The vulnerability, classified as CWE‑79, could be used to hijack user sessions, deface content, or exfiltrate confidential data. A successful exploit requires only that the attacker contends a crafted request through a URL or form and that the victim views or interacts with the response.

Affected is the CGD Arrange Terms WordPress plugin version 1.1.3 and older. Site owners running this plugin on any WordPress environment are vulnerable. No specific operating system or WordPress core version is singled out by the advisory.

With a CVSS score of 7.1 the issue falls into the high severity range. The EPSS score is below 1 %, indicating that exploitation is expected to be rare at the moment, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, because the flaw is reflected XSS, an attacker can easily target any logged‑in user by sending a link or embedding it in a malicious email. Based on the description, the likely attack vector is the web interface, and no local privilege escalation or remote code execution is required.