The Landing Page Cat WordPress plugin does not neutralize user input displayed in web pages, allowing attackers to embed malicious JavaScript via a crafted request. This reflected XSS can execute in the victim’s browser, enabling session hijacking, cookie theft, or other client‑side attacks, as described by CWE‑79.

WordPress installations that have the fatcatapps Landing Page Cat plugin version 1.7.7 or earlier are vulnerable. The issue applies to all releases from the beginning through 1.7.7.

The CVSS score of 7.1 conveys moderate to high impact, while the EPSS score of less than 1% indicates a low current exploitation probability; the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a web request containing malicious input; an attacker can send a crafted URL to a target user, who will execute the injected script when the page renders.