The Teleport WordPress plugin contains an improper neutralization of user input during page generation, classified as CWE‑79. Malicious users can inject script code that is reflected in the browser when the plugin processes a crafted URL or form submission, enabling exploitation such as session hijacking, cookie theft, defacement, or phishing delivery through the victim’s browser.

Any WordPress installation running srcoley Teleport plugin version 1.2.4 or earlier is affected. The vulnerable code exists across all released versions up to and including 1.2.4.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% suggests the likelihood of active exploitation is low but not negligible. The vulnerability is remote, browser‑based, and requires the victim to visit a specially crafted URL or interact with a populated form. Although it is not listed in the CISA KEV catalog, its potential for social‑engineering campaigns and the high impact of XSS warrants proactive mitigation.