The plugin fails to escape or validate user input that is reflected back into a generated web page. An attacker can supply malicious JavaScript in a request and cause that code to run in any victim’s browser. This can lead to credential theft, defacement, or execution of further malicious actions in the context of the victim’s logged‑in session. The weakness is a classic reflected XSS flaw (CWE‑79).

WordPress sites that have the SuryaBhan Custom Coming Soon plugin installed in any version up to and including 2.2 are subject to this vulnerability. No other vendors or product families are listed as affected.

The vulnerability has a CVSS score of 7.1, indicating a medium severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the issue is not catalogued in the CISA KEV list. The likely attack vector is a reflected XSS, where an attacker crafts a URL or form payload that includes malicious script, which the vulnerable plugin then echoes back into the response without proper encoding. Only a user who loads the crafted page in a browser would be affected, so the scope is limited to client‑side compromise.