The flaw is an improper neutralization of user input in the ajitae Google Plus WordPress plugin, allowing a reflected XSS attack. In a reflected XSS scenario a malicious actor can inject crafted JavaScript into a URL or form field that the plugin reflects back into the rendered page. When an unsuspecting user visits the manipulated link or page, the injected script runs in the victim’s browser context, potentially stealing authentication cookies, defacing the site, or redirecting the user to malicious domains. The vulnerability stems from a failure to encode or sanitize user‑supplied data before output, a classic example of CWE‑79.

The affected product is the Google Plus WordPress plugin developed by ajitae. All versions from the earliest release through version 1.0.2 are impacted. No other versions or variants were reported as vulnerable.

The CVSS base score of 7.1 indicates a high severity, but the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not currently listed in the CISA KEV catalog. Likely attack vectors involve a reflected XSS payload embedded in a URL or query parameter that the plugin echoes back in a template. Successful exploitation requires a victim to open a crafted link, so it is limited to social‑engineering or phishing campaigns.