The IE CSS3 Support plugin for WordPress includes an improper neutralization of input during page generation, leading to a reflected cross‑site scripting vulnerability. An attacker could supply crafted input via a URL or form that the plugin does not sanitize, resulting in the execution of malicious scripts in the context of users who view the affected page.

Vulnerable installations are WordPress sites that currently use the CI, Dino IE CSS3 Support plugin version 2.0.1 or earlier. The patch set was informed by the vendor only up to version 2.0.1, with no stable release beyond that stated.

The CVSS score of 7.1 categorizes this flaw as high‑severity. The EPSS score of less than 1% indicates a low but non‑zero probability that exploitation is occurring in the wild, and it is not listed in the CISA KEV catalog. Because it is a reflected XSS, an attacker would need to lure a victim to a crafted URL or supply input to a form that invokes the plugin, then wait for the victim’s browser to render the response. This can lead to defacement, cookie theft, or credential phishing and is generally considered a high‑impact threat that can be mitigated by vendor support or by disabling the plugin.