The vulnerability is a reflected XSS flaw that occurs when user‑supplied input is incorporated unchecked into HTML responses. An attacker can embed malicious scripts that run in the context of anyone who visits a crafted URL, potentially enabling session hijacking, credential theft, or defacement. The primary weakness is improper input neutralization, classified as CWE‑79.

The affected product is the WordPress GNUPress plugin released by kagla, version 0.2.9 and all earlier releases. The vulnerability applies to any WordPress installation that has this plugin active and has not applied the fix included in later releases.

The CVSS score of 7.1 indicates a high severity. The EPSS score of less than 1% shows a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a reflected XSS path, where the attacker crafts a URL containing malicious input and lures a victim to click it. Exploitation requires user interaction and does not grant code execution or server compromise beyond the victim's browser context.