The vulnerability is an improper neutralization of user-supplied input during page rendering in the DivSpark Flagged Content WordPress plugin, allowing an attacker to inject malicious scripts that execute in the victim’s browser when a crafted URL is visited. This reflected XSS can be used to steal session cookies, deface content, or launch phishing attacks against site users, and it maps to CWE‑79.

All WordPress sites that have installed DivSpark’s Flagged Content plugin version 1.0.2 or earlier are affected. Any installation using these versions of the plugin is vulnerable, regardless of other plugins or theme versions.

The CVSS base score of 7.1 indicates high impact on confidentiality and integrity. The EPSS score of less than 1 % shows exploitation probability is very low but still present, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw simply by persuading a user to click a malicious link; no special authentication or privilege escalation is required.