Improper neutralization of user-supplied input during web page generation in the WPYog Documents plugin (versions 1.3.5 and earlier) allows attackers to inject malicious scripts that are reflected back to the visitor. These scripts execute with the privileges of the page, enabling an attacker to steal session data, deface content, or redirect users to phishing sites. The vulnerability is a standard reflected XSS, classified under CWE‑79.

The vulnerability affects the WordPress WPYog Documents plugin supplied by PoppinsDigital.com. Versions from the initial release through 1.3.5 are impacted. All installations of this plugin running those releases are potentially vulnerable.

The CVSS score of 7.1 indicates a high impact if exploited, while the EPSS score of less than 1% suggests a low likelihood of automated exploitation at this time. The plugin is not listed in the CISA KEV catalog. Exploitation can occur when a remote user is tricked into visiting a crafted URL or a maliciously composed form submission that the vulnerable plugin echoes back to the page.