The vulnerable WP Download Codes plugin fails to properly neutralize user input before rendering it into a web page, enabling any attacker to inject and execute arbitrary JavaScript when a victim loads a crafted URL. This reflected XSS flaw can lead to session hijacking, cookie theft, defacement, or the execution of malicious code in the victim’s browser.

The flaw is present in the misanthrop WP Download Codes plugin for WordPress for all releases up to and including 2.5.4. Sites that have installed any of these versions, regardless of whether the plugin is active or receiving traffic, are potentially exposed if visitors can be directed to URLs containing the vulnerable parameters.

The reported CVSS score of 7.1 reflects a medium‑high severity, and the EPSS score of less than 1% indicates that, while exploitation is considered low probability, it remains plausible. The vulnerability is not yet catalogued in the CISA KEV list. Attackers can reach the vulnerable endpoint over the network by crafting a URL that includes the unsanitized parameter; the attack is feasible in a browser context without needing special privileges.