The vulnerability is an improper neutralization of input that allows attackers to inject arbitrary JavaScript into the web page generated by the WordPress Lightview Plus plugin. A reflected XSS flaw permits malicious code to run within the browser context of any user who views the vulnerable page, potentially leading to session hijacking, cookie theft, defacement, or the execution of further attacks. This flaw is identified as CWE‑79.

The affected product is the WordPress Lightview Plus plugin developed by puzich. Versions from the initial release up through 3.1.3 are vulnerable. No other versions are listed as affected.

The CVSS base score of 7.1 indicates a high risk of exploitation. The EPSS score of less than 1% shows a low probability that attackers are actively trying to exploit the flaw, and it is not listed in the CISA KEV catalog. The attack vector is inferred from the description as remote via a crafted URL or form input that is reflected to the victim’s browser. Attack complexity is low and requires user interaction; the impact is limited to the victim’s browser session and does not permit remote code execution on the server.