The Digital License Manager plugin for WordPress contains a reflected cross‑site scripting flaw caused by the use of the remove_query_arg() function without proper escaping. An unauthenticated attacker can embed arbitrary JavaScript in a URL, which is subsequently reflected in pages when a user follows the link or performs an action that triggers the URL. This allows attackers to run malicious scripts in the context of the victim’s browser, potentially stealing cookies, hijacking sessions, defacing content or installing malware.

WordPress sites running codeverve Digital License Manager versions 1.7.3 and earlier are affected. The vulnerability exists in all supported releases up to and including 1.7.3 of the plugin.

The CVSS score of 6.1 indicates a medium severity flaw, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to craft a malicious URL that the victim follows, which can be achieved through phishing or social engineering. Once the victim clicks the link, the injected script executes with the permissions of the logged‑in user, exposing the site to session theft or defacement.