The Driving Directions plugin for WordPress contains an improper neutralization of user input during web page generation, allowing malicious code to be injected into a page viewed by users. This reflected XSS flaw could enable an attacker to execute scripts in the victim's browser, potentially leading to session hijacking, credential theft, or defacement of the site. The weakness is a classic CWE‑79 "Improper Neutralization of Input" scenario.

Affected products are the WordPress Driving Directions plugin (v. hectorgarrofe:Driving Directions), with all releases up to and including 1.4.4 susceptible. The plug‑in version hierarchy is not further refined in the CVE data, so any installation using a version <=1.4.4 is considered vulnerable, irrespective of the WordPress core version.

The vulnerability carries a CVSS score of 7.1, denoting moderate‑to‑high impact. The EPSS score is below 1 %, suggesting that, as of the most recent data, the probability of exploitation is low but not zero. The flaw is not listed in the CISA KEV catalog. Based on the nature of reflected XSS and the public availability of the Vulnerability references, it is inferred that a remote attacker could trigger the flaw by crafting a malicious URL and inviting a user to click it; the vulnerability activates during normal page rendering.