The RaminMT Links/Problem Reporter plugin for WordPress is vulnerable to Reflected Cross‑Site Scripting because it fails to neutralize user input before rendering it in the web page. This flaw allows an attacker to inject malicious script into pages that other users view, resulting in arbitrary script execution in the victim’s browser.

The vulnerability affects the RaminMT Links/Problem Reporter plugin version 2.6.0 and earlier. Any WordPress site that has installed or updated to one of these versions without applying a fix is vulnerable. The plugin is commonly used to report broken links on WordPress sites.

The CVSS score of 7.1 indicates high impact under standard conditions, while the EPSS score of <1% shows a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated user visiting a crafted URL that includes malicious script content, making the exploitation straightforward for attackers who can send victims URLs that the plugin will echo back.