The accessiBe Web Accessibility By accessiBe WordPress plugin contains a reflected Cross‑Site Scripting flaw caused by failure to neutralize user input before rendering a page. When a malicious URL is crafted, the attacker can inject JavaScript that runs with the privileges of the visitor, potentially stealing cookies or executing further malicious actions within the user’s browser context.

All installations of the accessiBe Web Accessibility By accessiBe plugin running WordPress sites with versions up to and including 2.5 are affected. No specific patch version is listed, so the issue persists through all releases prior to 2.6.

The CVSS score of 7.1 indicates a medium‑high risk. The EPSS score of < 1% shows that the likelihood of exploitation is low, and the vulnerability is not currently featured in the CISA KEV catalog. Exploitation requires a user to visit a specially crafted URL, so the attack vector is remote via the web. No additional prerequisites are noted in the provided information.