The vulnerability exists in the WP Wall plugin for WordPress and allows an attacker to inject malicious scripts into the page output. Because the plugin does not properly neutralize input, an attacker can place JavaScript in a reflected parameter that is then executed in the victim’s browser. The resulting cross‑site scripting can be used to steal session cookies, deface content, or perform other client‑side attacks.

The flaw is present in all published releases of the WP Wall plugin from the first version to and including version 1.7.3. Any WordPress site that has this plugin installed at or below that version is vulnerable.

The CVSS score of 7.1 indicates a medium‑to‑high severity for the vulnerability. The EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker can leverage it by sending a crafted URL or link containing a malicious script to an unsuspecting user; when that user clicks or navigates to the URL, the script runs in their browser, exploiting the vulnerability.