The vulnerability is an Improper Neutralization of Input During Web Page Generation that allows reflected Cross‑Site Scripting. Unescaped input is incorporated into web pages, enabling an attacker to inject arbitrary JavaScript. This can compromise user credentials, deface content, or facilitate phishing, posing a substantial risk to confidentiality and integrity of site visitors. The weakness is classified as CWE‑79.

WordPress plugin Display Post Meta by Kyle Maurer is affected. All released versions from the initial version through 2.4.4 are vulnerable. Updating to a later release, where the issue is fixed, is essential.

The CVSS score of 7.1 indicates high severity. The EPSS score is below 1 %, suggesting a low probability of opportunistic exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the public web interface; an attacker can craft a link or input that triggers the reflected XSS when users visit the site. Exploitation requires a victim to open the maliciously crafted page, but the impact occurs entirely in the victim’s browser.