Improper neutralization of input when generating web pages for the Easy Filter plugin allows a remote attacker to inject malicious scripts that execute in the victim’s browser. The vulnerability applies to all versions up to 1.10. An attacker can craft a URL or form input that will be reflected unescaped in the page, enabling script execution that can steal sessions, deface content, or spread malware.

The affected product is the Easy Filter plugin developed by Roni Saha. Installations of the plugin version 1.10 or earlier are vulnerable.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% shows that the likelihood of exploitation is currently low. The vulnerability is not listed in CISA KEV. Attackers would most likely exploit this via a crafted request delivered to a victim’s browser, possibly exploiting social engineering or phishing.