A reflected XSS flaw exists in the Term Taxonomy Converter plugin. Unsanitized user input supplied to the plugin is echoed back in a generated web page, allowing an attacker to inject malicious scripts that run in the context of the victim’s browser. This can lead to credential theft, session hijacking, defacement and other compromises of confidentiality, integrity or availability for users who view affected content.

WordPress sites running the Term Taxonomy Converter plugin version 1.2 or earlier by Dhanendran Rajagopal. No further version granularity is specified beyond the <= 1.2 bound.

The CVSS score of 7.1 indicates a medium‑to‑high severity, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is reflected: a crafted URL or payload must be delivered to a victim who views the page. Inferred from the lack of privilege restrictions, local privilege is not required; the impact is limited to the browser session of the victim. Attackers can execute arbitrary JavaScript in the victim’s context, enabling typical XSS‑related exploits.