The Advanced Post Search plugin contains an Improper Neutralization of Input During Web Page Generation flaw that allows an attacker to inject malicious script code into search queries. When a query is reflected in the web page without proper escaping, the browser executes the script in the context of the site. This can enable an attacker to hijack user sessions, steal credentials, deface content or perform other malicious actions. The vulnerability is a classic input‑validation problem identified by CWE‑79.

The affected product is VarDump s.r.l.'s Advanced Post Search plugin for WordPress. Versions up to and including 1.1.0 are vulnerable. All installations using these or earlier releases are susceptible, regardless of the underlying WordPress version.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the reflected XSS by supplying a crafted search query through the public web interface, typically via HTTP GET parameters. If a victim’s browser renders the malicious payload, the attack will succeed.