An input validation flaw in the WordPress One Backend Language plugin causes user supplied data to be incorporated into web pages without proper encoding. This reflected cross‑site scripting vulnerability, classified as CWE‑79, allows an attacker to embed malicious scripts that will execute in the browsers of anyone who visits a crafted URL. The consequences include theft of session cookies, defacement of web pages, and the ability to redirect users to phishing sites.

The flaw is present in the One Backend Language plug‑in developed by Martijn Juhasz, affecting version 1.0 and all earlier releases that are deployed on WordPress sites. Any site that has this plug‑in installed is susceptible to the reflected XSS attack.

The flaw carries a CVSS score of 7.1, indicating a moderate level of severity. With an EPSS score below 1%, the likelihood of exploitation in the wild is low, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by directing users to a crafted link that includes malicious input; no authentication or privileged access is required. The vulnerability can lead to full control of the victim’s browser session.