The WP2APP plugin contains an improper neutralization of input during web page generation that allows attackers to inject malicious content. Because the plugin echoes user‑supplied data without sanitizing it, an attacker can craft a URL or form that returns a page containing a script. A victim who views the crafted page would have that script execute in their browser, enabling cookie theft, session hijack, or defacement.

All WordPress installations running WP2APP 2.6.2 or earlier are vulnerable. The flaw exists in every release up to and including 2.6.2, so any use of the plugin poses a risk for the hosting site.

The vulnerability has a CVSS score of 7.1, indicating high impact. The EPSS score is reported as less than 1 percent, implying a low likelihood of exploitation, although the flaw is still technically exploitable. It is not listed in CISA’s KEV catalog. The likely attack vector is the inclusion of malicious input in URLs or POST data that the plugin reflects back in the page. No automated exploit is documented, so manual testing is required for exploitation.