The vulnerability is an improper neutralization of user input during web page generation in the LawPress plugin up to version 1.4.5. When a reflected input value is rendered without proper escaping, an attacker can inject arbitrary JavaScript into the page that is then executed in the context of any visitor who loads the crafted URL. This enables attackers to steal session cookies, deface content, or perform further exploitation on the victim’s browser.

The affected product is the LawPress – Law Firm Website Management plugin provided by ivanchernyakov. Versions from the earliest available release through version 1.4.5 are impacted. Any WordPress site that has installed one of these versions without a later version is vulnerable.

The CVSS score of 7.1 indicates a moderate to high severity, while the EPSS score of less than 1% suggests that the probability of exploitation is low at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to supply a malicious input parameter to a publicly reachable page. The likely attack vector is a crafted HTTP request that includes the injected script in a query string or form field that the plugin echoes back in the response.