The First Comment Redirect plugin for WordPress fails to properly escape user supplied input when rendering a page, enabling an attacker to embed malicious JavaScript that executes in the victim’s browser. The flaw is a classic reflected XSS (CWE‑79) that can lead to session hijacking, credential theft, defacement, or the initiation of additional attacks. The impact is limited to users who load a page that includes the unfiltered input, but the consequences for compromised users can be significant.

The vulnerable component is the WordPress plugin "First Comment Redirect" developed by robin90. Versions from the original release through 1.0.3 are affected; sites running any release up to and including 1.0.3 are at risk.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog, implying no known active exploitation. The most probable attack vector is a reflected request containing user‑controlled parameters, which an attacker can deliver via a crafted URL or hidden form field, requiring the victim to visit the malicious link for the injected script to execute.