The DeBounce Email Validator plugin contains an improper neutralization of input during web page generation that allows reflected cross‑site scripting. This flaw permits the injection of malicious scripts into pages rendered by the plugin, so an attacker can execute arbitrary code in the browsers of visitors who view those pages. Such code could steal cookies, redirect users, or deface the site, thereby compromising the confidentiality, integrity, and availability of the affected WordPress installation.

This vulnerability affects the WordPress DeBounce Email Validator plugin provided by debounce, specifically versions up to and including 5.6.5.

The CVSS score of 7.1 indicates a high severity; the EPSS score of less than 1% suggests a low probability of exploitation at the moment, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would likely exploit this reflected XSS flaw by embedding malicious script payloads into URLs or form data that the plugin echoes back to the visitor, which can be triggered from a remote host in a straightforward way.