Thorsten Ott’s Debug‑Bar‑Extender plugin for WordPress contains an improper neutralization of input during web page generation, allowing attackers to inject arbitrary JavaScript via unsanitized query parameters. The flaw manifests as a reflected cross‑site scripting vulnerability, meaning users who view a maliciously crafted URL can have unintended scripts executed in their browser. This can lead to session hijacking, cookie theft, or malicious content injection if not mitigated.

The vulnerability impacts WordPress sites that have the Debug‑Bar‑Extender plugin version 0.5 or earlier installed. Sites that enable the plugin expose any user that navigates to the site’s URLs to the risk of reflected XSS.

The CVSS score of 7.1 indicates high severity, yet the EPSS score is below 1%, suggesting a low exploitation probability so far. The flaw is not listed in the CISA KEV catalog. The likely attack vector is remote exploitation via a crafted link, requiring no authentication but relying on victims to open or click the malicious URL. If a user befriends such a link through phishing or malicious advertisement, the injected script would run with the user’s privileges.