David Tufts WP Cards until version 1.5.1 fails to neutralize user input when generating web pages, exposing a Reflected Cross‑Site Scripting vulnerability (CWE‑79). This flaw can cause arbitrary JavaScript to run in the browser of any visitor who loads a crafted page, enabling attackers to steal session cookies, deface content, or redirect users to malicious sites. The exploitation would compromise confidentiality and integrity of data viewed by affected users.

Any WordPress site that has the WP Cards plugin installed with a version 1.5.1 or earlier. No additional sub‑version or patch information is listed; the entire range from the initial release through 1.5.1 is affected.

The CVSS score of 7.1 indicates a high‑severity condition, while the EPSS score of less than 1 % suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to embed malicious input that is reflected back by the plugin’s front‑end, typically via a crafted URL or form submission. Once a victim loads the infected content, the injected script runs with the victim’s browser privileges.