The Easy Bet plugin contains an improper neutralization of input during web page generation, resulting in a reflected XSS vulnerability. An attacker can craft a URL that includes malicious JavaScript, which the plugin will echo back in the browser. When a user visits the URL, the injected code runs in the context of the site, potentially stealing session cookies, hijacking accounts, or launching phishing attacks. The weakness corresponds to CWE‑79.

Foxskav Easy Bet, a WordPress plugin, is affected in all releases up to and including version 1.0.7. No earlier affected version is specified; thus any installation of Easy Bet 1.0.7 or older is vulnerable. The plugin is available in the WordPress repository.

The CVSS score is 7.1, indicating a high severity. The EPSS score is below 1 percent, suggesting low current exploitability in the wild. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit the reflected XSS by accessing a specially crafted URL from a browser; no authentication or elevated privileges are required. Once executed, the attacker can perform client‑side attacks such as cookie theft or session hijacking. Because the flaw is a plain reflected XSS, it is easy to trigger with a single HTTP request, making the attack straightforward for malicious users or automated scanners.