Improper neutralization of user‑provided input in OTWthemes Content Manager Light causes reflected cross‑site scripting (XSS). An attacker who can place specially crafted data in a request can cause the web page to execute arbitrary JavaScript in the victim’s browser. The CWE‑79 weakness allows attackers to steal session cookies, deface the site, or execute further malicious actions.

The flaw affects all versions of the Content Manager Light plugin up to and including 3.2, as released by OTWthemes. WordPress sites that install this plugin and rely on its public pages or query parameters are vulnerable. No specific patch version was listed, so any deployment using 3.2 or older is at risk.

The CVSS score of 7.1 identifies the vulnerability as fairly severe, and an EPSS below 1% indicates that current exploitation activity is very low and likely relies on social‑engineering techniques. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to visit a malicious URL that passes the vulnerable query string to the plugin, after which the reflected script runs in the victim’s browser context.