The vulnerability is an improper neutralization of input during web page generation that allows a reflected cross‑site scripting attack. An attacker can supply malicious input via a request parameter and have it included in the response without proper encoding, enabling the execution of arbitrary JavaScript in a victim’s browser. This can facilitate session hijacking, credential theft, defacement or malicious redirection from the perspective of the user who visits the crafted URL.

The affected product is Metagauss RegistrationMagic, a WordPress plugin. Versions from the first release through 6.0.3.3 are vulnerable. Any WordPress site that has this plugin installed within that version range is at risk.

The CVSS score of 7.1 indicates a high severity. The EPSS score of less than 1% shows a very low probability of exploitation at the time of analysis, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the attack vector is likely remote via crafted HTTP requests, and an attacker only needs to lure a user to a malicious URL. The vulnerability is technically easy to exploit once the user clicks the link, so sites should consider it a high operational risk.