The vulnerability is a reflected Cross‑Site Scripting flaw that allows an attacker to inject malicious scripts into webpages generated by the plugin. The flaw arises from improper neutralization of user input during page rendering, giving an attacker the ability to execute arbitrary JavaScript while a user browses a page that includes the vulnerable plugin. This can lead to session hijacking, credential theft, data exfiltration, or defacement of the site.

The issue affects the WordPress plugin Authors Autocomplete Meta Box created by Rachel Cherry. All installations running version 1.2 or earlier—no minimum version is specified—are vulnerable.

The CVSS score of 7.1 indicates a high severity for this vulnerability. The EPSS score of less than 1% suggests a low probability of exploitation at any given time, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the likely attack vector is via a crafted URL or form input that is reflected back to the user, allowing a remote attacker to craft a malicious link or embed the attacker’s script in a request that users may click. The flaw does not require authentication and can be leveraged by any user visiting a vulnerable page.