This vulnerability is an instance of Improper Neutralization of Input During Web Page Generation. The WPPizza plugin fails to escape user controlled data before displaying it, allowing attackers to inject and execute arbitrary JavaScript in the context of the affected WordPress site. Compromise of the site could enable session hijacking, defacement, or phishing attacks directed at visitors or administrators.

The flaw affects the WordPress plugin named WPPizza published by ollybach. Versions from the first release through 3.19.4 are vulnerable; any released version at or prior to that point is exposed.

The CVSS score of 7.1 reflects a high severity due to the potential for widespread impact, while the EPSS score of less than 1% indicates a low likelihood that the vulnerability will be actively exploited now. The flaw is not listed in the CISA KEV catalog. The attack vector can be inferred to be reflected, involving crafted URLs or form inputs that are echoed back to the browser without proper sanitization, which means any visitor to a vulnerable page could trigger the payload. Without authentication requirements, this represents a straightforward exploit path for malicious actors.