Improper neutralization of user input during web page generation allows an attacker to inject malicious scripts that run in the victim’s browser. The flaw is a reflected XSS vulnerability in the redqteam Alike – WordPress Custom Post Comparison plugin. If successfully exploited, attackers could steal session cookies, deface content, or redirect users to malicious sites.

The issue affects the redqteam Alike – WordPress Custom Post Comparison plugin on WordPress sites. Versions from the earliest available through and including 3.0.1 are vulnerable. Any WordPress installation that has this plugin deployed and has not applied a newer version is at risk.

The CVSS score of 7.1 indicates a medium‑to‑high severity flaw, while the EPSS score of less than 1% suggests a low likelihood of active exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need only to craft a malicious URL and lure a user to that link; authentication or elevated privileges are not required. The flaw operates entirely via the web interface and does not require additional system access.