The Migrate Posts plugin (versions up to 1.0) contains Improper Neutralization of Input During Web Page Generation, allowing attackers to inject reflected XSS payloads. This weakness, classified as CWE‑79, permits an attacker to embed malicious script into pages served by the site, potentially executing code in the victim's browser session and leading to defacement, credential theft, or session hijacking. The impact is limited to the browser context of users who interact with the vulnerable plugin’s output, but it can compromise site integrity and user security.

WordPress plugin "Migrate Posts" developed by Dotsquares Ltd, affected versions are all releases up to and including 1.0.

The CVSS score indicates a high severity of 7.1. The EPSS score of less than 1% shows a low probability of exploitation as of now, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is reflected input via URLs or form fields handled by the plugin; this is inferred because the description states the flaw allows reflected XSS.