The Yahoo BOSS plugin for WordPress contains an improper neutralization of input during page generation that permits reflected XSS. This flaw is classified as CWE‑79 and can allow a malicious actor to inject and execute arbitrary JavaScript in the context of a viewer’s browser, potentially leading to session hijacking, cookie theft, or defacement of the site’s content.

WordPress sites that use the Yahoo BOSS plugin by Josh Harrison are affected, specifically plugins ranging from the initial release through at least version 0.7. If a site has not upgraded beyond 0.7, it remains vulnerable.

The CVSS base score of 7.1 indicates a high severity, while the EPSS score of less than 1% suggests low current exploitation probability, though the flaw is not listed in the CISA KEV catalog. The likely attack vector is a crafted URL or form input that the plugin displays without proper escaping. Upon exploitation, an attacker can inject malicious scripts that run when a user views the affected page, exploiting the site’s trust in its own content.