The flaw originates from improper neutralization of user-supplied input during web page generation in the Gravity 2 PDF plugin. The plugin does not escape certain characters in incoming query parameters, allowing an attacker to inject arbitrary JavaScript that executes in the victim’s browser. This reflected XSS can enable credential theft, session hijacking, malicious redirects, and site defacement and is directly linked to CWE‑79, with a CVSS score of 7.1.

The vulnerability affects the WordPress Gravity 2 PDF plugin in all versions up to and including 3.1.3. Any WordPress installation that has this plugin installed at a vulnerable version is at risk.

The vulnerability carries a moderate‑to‑high risk rating with a CVSS score of 7.1, while the EPSS score is under 1 %, indicating a low probability of exploitation in the wild; it is not currently listed in the CISA KEV catalog. The attack vector is likely achieved through reflected XSS, whereby an attacker crafts a malicious URL or input that the plugin includes unescaped in a generated page. Exploitation requires only that a victim’s browser renders the page with the injected payload, making the risk primarily dependent on user interaction.