An attacker can embed malicious scripts that are reflected back into the HTTP response by entering specially crafted input through the InFunding plugin’s parameters. The payload is executed in the victim’s browser when the URL is visited, enabling cookie theft, session hijacking, defacement, or other client‑side attacks. The CVSS score of 7.1 indicates high severity and the vulnerability is exploitable without authentication or elevated privileges.

The InFunding plugin by inwavethemes, version 1.0 and earlier is affected. No specific sub‑versions are listed, so all releases through 1.0 are impacted.

The plugin’s input fields are exposed to the web front‑end, making the attack vector website‑directed and easily reachable via phishing or social‑engineering. Although the EPSS score is below 1%—suggesting a low exploitation probability at present—the vulnerability’s high severity and the commonality of XSS exploitation mean an attacker could still achieve user compromise if this issue is publicized. The vulnerability is not listed in the CISA KEV catalog, but its impact remains significant.