The flaw results from improper neutralization of user input during web page generation, allowing attackers to inject malicious scripts that execute in a victim’s browser context. These scripts can steal session cookies, perform unauthorized actions on behalf of the user, deface the site, or redirect the user to malicious pages. The impact is confined to the web browser session of the victim and can lead to confidentiality and integrity violations within the site.

WordPress plugin Simple Post Series by chaozh, versions up to and including 2.4.4 are vulnerable. Any installation of this plugin that has not been upgraded to a later release contains the reflected XSS weakness.

With a CVSS score of 7.1, the vulnerability is classified as high severity, yet the EPSS score is under 1% indicating a low probability of exploitation in the near term. The plugin is not listed in the CISA KEV catalog. Exploitation requires a victim to visit a specially crafted URL or input field that the plugin renders without proper escaping, a scenario that can be leveraged through phishing or social‑engineering campaigns. An attacker with moderate technical skill can therefore pose a threat to any site using the affected plugin.