The vulnerability is an Improper Neutralization of Input During Web Page Generation, specifically a reflected Cross‑Site Scripting flaw. An attacker can inject malicious scripts that are executed in the victim’s browser when a crafted URL or form is accessed. This can lead to session hijacking, phishing, or delivery of malware, compromising the confidentiality and integrity of the web application and its users. The weakness is identified as CWE-79.

The flaw affects the WisdmLabs Edwiser Bridge WordPress plugin in all releases up to and including 3.0.8. Users running any of these versions on a WordPress installation are potentially exposed.

The CVSS score of 7.1 indicates a moderate severity. The EPSS score is below 1 %, suggesting a very low probability of exploitation in the wild at this time, and it is not listed in the CISA KEV catalog. The likely attack vector is a web‑based front‑end input—such as query string parameters or form fields—that reflects user data without proper sanitization, allowing the attacker to deliver and execute scripts in a victim’s browser.