The devu Status Updater plugin contains an improper neutralization of input during web page generation, enabling a reflected cross‑site scripting (XSS) flaw (CWE‑79). An attacker can embed malicious scripts that are echoed back to the user, allowing arbitrary client‑side code execution. This can lead to cookie theft, session hijacking, site defacement, or phishing campaigns that exploit the victim’s browser environment.

The vulnerability affects the WordPress Status Updater plugin developed by devu, with all releases from the first build up to and including version 1.9.2. Hosts that have not applied the latest security fixes are at risk.

With a CVSS score of 7.1 the flaw is of moderate to high severity, while an EPSS score of less than 1% indicates a very low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no known production exploitation. The likely attack vector is a crafted URL that triggers the plugin’s reflected output, which an attacker could distribute via email, social media, or other channels. Exploitation requires the victim to open the malicious link, after which client‑side code runs within the context of the affected WordPress site.