Affected content: the Beacon Lead Magnets and Lead Capture WordPress plugin generates web pages using user input without proper neutralization, resulting in reflected cross‑site scripting. An attacker who can inject malicious scripts into query parameters or form fields that are subsequently reflected in the page will execute code in the victim’s browser. This can allow session hijacking, credential theft, defacement, or the delivery of malware.

The vulnerability affects the Syed Balkhi Beacon Lead Magnets and Lead Capture WordPress plugin, versions from the initial release through 1.5.7 inclusive. WordPress sites that have installed any of these plugin versions are susceptible to the reflected XSS flaw.

The CVSS score of 7.1 indicates a high severity. The EPSS score of less than 1% shows that exploitation is currently considered unlikely, and the flaw is not currently listed in CISA’s KEV catalog. Nevertheless, the attack path is straightforward: an attacker can supply malicious input via public URLs or form fields that the plugin reflects, and no authentication is required. The absence of authentication checks and improper input sanitization make this a low‑barrier vulnerability for malicious actors, especially on sites with high user interaction.