The WP2LEADS plugin for WordPress has an improper neutralization of input when generating web pages, resulting in a reflected XSS flaw. An attacker can craft a URL containing malicious JavaScript that is echoed back in the page response. When an end‑user opens this URL, the browser will execute the injected script, enabling the attacker to steal session cookies, deface the site, or perform other actions with the victim's privileges.

WordPress sites that have the Saleswonder Team: Tobias WP2LEADS plugin installed at any version up to and including 3.3.3 are vulnerable. This includes sites using older or unpatched releases of the plugin, regardless of additional WordPress version or other plugins.

The vulnerability carries a CVSS score of 7.1, indicating a high severity impact. The EPSS score is under 1%, suggesting a low probability of exploitation currently, but the flaw is widely known and could be used by automated scanners. It is not listed in the CISA KEV catalog. Exploitation is achievable by sending a crafted URL to any visitor of the affected WordPress site; the attacker requires no special privileges, making the threat vector remote and easily reachable.