The flaw is an improper neutralization of input during web page generation, allowing an attacker to inject malicious code that is reflected back to the user’s browser. This flaw can lead to the execution of arbitrary scripts, enabling attackers to steal session cookies, deface pages, or launch further attacks. The vulnerability is a classic XSS (CWE‑79) that compromises confidentiality and integrity of the affected user’s session.

All installations of BjornW File Icons plugin with versions up to and including 2.1 are vulnerable. Users who run any of these versions should consider their plugin installation an affected system.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1 % suggests a low probability of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog, but attackers could still leverage it by crafting a malicious URL that includes the vulnerable parameter. When visited, the script runs in the user’s browser, potentially compromising account data and enabling further compromise. Risk is moderate to high for users who do not protect themselves with additional controls.