This vulnerability arises from improper input neutralization in the Tidekey WordPress plugin, permitting reflected XSS. A malicious user can inject arbitrary HTML or JavaScript into a page rendered by the plugin, potentially stealing user credentials, defacing content, or delivering malware. The weakness is a classic XSS flaw (CWE‑79).

WordPress sites running the makong Tidekey plugin version 1.1 or earlier. Any instance where the plugin is active and accessible to public visitors or authenticated users is potentially affected.

The CVSS score of 7.1 indicates a high severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a crafted URL that triggers the reflected XSS through the plugin’s unsanitized output, allowing an attacker to execute arbitrary code in the victim’s browser. Until a patch or mitigation is applied, the vulnerability remains exploitable on affected sites.