The WP Pipes plugin contains an improper neutralization of input during web page generation flaw that allows attackers to inject malicious script code. This is a reflected XSS (CWE‑79). Based on the description, it is inferred that an attacker could cause malicious scripts to run in the victim’s browser, potentially stealing cookies, hijacking sessions, defacing the site, or delivering further malware.

WordPress sites using the WP Pipes plugin version 1.4.3 or earlier, distributed by ThimPress, regardless of the WordPress core version.

The CVSS score of 7.1 indicates a high severity. The EPSS score of less than 1% shows low current exploitation likelihood, but the vulnerability remains a real threat because it only requires a crafted URL and no authentication. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is a reflected request using untrusted user‑supplied parameters that are not properly sanitized by the plugin.