The Stray Random Quotes plugin for WordPress improperly sanitizes user input, enabling attackers to inject arbitrary scripts that are reflected back in the web page. By crafting a malicious URL that includes malicious JavaScript, an attacker can execute code in the browser of any visitor who clicks the link, resulting in cookie theft, session hijack, or defacement. The vulnerability is a classic reflected XSS flaw (CWE–79) and requires the victim to load a crafted request.

The flaw exists in the unalignedcoder Stray Random Quotes plugin for WordPress, affecting all installations that use version 1.9.9 or earlier. No lower bound was specified; therefore any release prior to 1.10 is potentially vulnerable.

The CVSS score of 7.1 denotes a high impact, while an EPSS score below 1 % suggests that exploitation attempts are currently rare. The vulnerability is not listed in CISA’s KEV catalog, further indicating limited exploitation in the wild. Exploitation requires a victim to visit a maliciously crafted URL, and the attacker needs only to embed the malicious script; no local privilege escalation is required. Thus the risk is moderate but mitigatable through timely patching.