Improperly sanitized input in the WordPress Bitcoin and Altcoin Wallets plugin allows attackers to inject JavaScript that is reflected back to the victim’s browser, enabling arbitrary script execution. This reflected XSS flaw (CWE-79) can be used to steal session cookies, deface the site, or redirect users to malicious pages.

The vulnerability affects the Bitcoin and Altcoin Wallets plugin developed by dashed‑slug.net for WordPress websites. Versions up to and including 6.3.1 are impacted; earlier releases may also contain the flaw but this is not confirmed.

The CVSS score of 7.1 indicates a high severity, while an EPSS score of less than 1% suggests low current exploitation probability. The flaw is not listed in the CISA KEV catalog. Attackers can exploit this reflected XSS by crafting a malicious link that includes the vulnerable parameter; victims who click the link or load the page will have arbitrary scripts executed in the context of their browser. The attack vector is remote and relies on user interaction, but once executed, it provides the adversary with the ability to compromise site integrity or steal user data.