The WP AntiDDOS plugin allows an attacker to inject malicious JavaScript into web pages that are served to users. The vulnerability is caused by failure to neutralize user supplied data before output, which enables reflected cross‑site scripting. This flaw can be used to trick a victim into executing attacker‑controlled scripts, leading to session hijacking, defacement or information theft.

The vulnerability is present in the WP AntiDDOS plugin developed by zzmaster, in all versions from the initial release (n/a) through 2.0 inclusive. Any WordPress site that has this plugin installed and is using a vulnerable version is affected.

The CVSS score of 7.1 classifies this flaw as Medium‑High severity. The EPSS score of less than 1% indicates a low probability of exploitation at the current moment, and the issue is not listed in the CISA KEV catalog. The attack likely involves constructing a malicious URL or form that the plugin incorporates into a page, and an active user viewing that page would be impacted. In environments where the plugin is exposed to external traffic, the risk of a successful attack is higher, whereas sites with restricted access and strict input filtering reduce the threat surface.