Improper neutralization of input during web page generation allows malicious content to be reflected back to a user’s browser. The flaw resides in the Frizzly WordPress plugin and can be leveraged to inject arbitrary JavaScript that executes in the context of the site, potentially hijacking user sessions, defacing pages, or facilitating phishing attacks. The vulnerability is classified as a CWE‑79 XSS issue and carries a CVSS score of 7.1, indicating moderate‑to‑high severity for users exposed to the affected code.

The Flaw affects the Abhishek Kumar Frizzly plugin, versions from its initial release up to and including 1.1.0. Any WordPress installation that has this plugin installed and enabled without an updated version is at risk.

The EPSS score is less than 1%, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted URL or input that the plugin reflects unescaped, leading a victim to visit a malicious link. While the attack vector is predominantly user‑initiated, the impact on the victim’s browser renders it a serious concern for sites that rely on Frizzly for safe browsing or link handling.