The OK Poster Group plugin fails to properly neutralize user supplied data that is reflected back in the page. When a visitor follows a crafted URL, the injected script runs in the victim’s browser, enabling credential theft, session hijacking, or page defacement. This flaw is a classic example of CWE‑79 Cross‑Site Scripting.

Any WordPress site that has the OK Poster Group plugin from svmidi installed in a version through 1.1 is affected. The issue exists in all prior releases and is resolved only in versions newer than 1.1.

With a CVSS score of 7.1 the vulnerability is considered high severity, but the EPSS score is below 1 %, implying a low probability of widespread exploitation at this time. The flaw is not listed in the CISA KEV catalog. Because the attack can be carried out remotely without authentication by delivering a malicious link, any user who visits an affected page is vulnerable.