The Loops plugin contains an improper neutralization of input during web page generation which can be exploited to inject malicious scripts via a reflected cross‑site scripting mechanism. This flaw allows an attacker to embed executable JavaScript in a URL that is returned unfiltered in the page response, potentially compromising user credentials, session tokens and allowing defacement or redirection.

The vulnerability applies to the WordPress plugin The Loops, version 1.0.2 and earlier, developed by Ulrich Sossou. Specific affected installations are those running any version equal to or lower than 1.0.2; versions newer than 1.0.2 are not impacted.

The CVSS score of 7.1 indicates a high severity. The EPSS score is below 1%, suggesting a low but non‑zero exploitation probability at this time. The issue is not listed in the CISA KEV catalog. Because the flaw is triggered by user‑controlled input reflected back to the browser, the most likely attack vector involves an attacker crafting a malicious link, sending it to a victim, and the victim clicking it while authenticated or while the site is publicly accessible. An attacker could then hijack sessions or deface the site.