The Quick Localization plugin fails to neutralize user input, resulting in reflected XSS that allows an attacker to inject and execute arbitrary JavaScript in the victim’s browser. This client‑side script execution can lead to phishing, cookie theft, or malicious site redirection. The weakness is classified as CWE‑79.

WordPress sites that have installed the Quick Localization plugin by Name.ly, version 0.1.0 or earlier, are vulnerable. Any installation that accepts user input via this plugin can be exploited.

The CVSS score of 7.1 signals high severity; the EPSS score below 1% indicates a low probability of exploitation at present, and the vulnerability is not in the CISA KEV catalog. Based on the description, it is inferred that the plugin reflects user input without proper neutralization, allowing an attacker who can control a request parameter to execute code in a victim’s browser. The lack of input validation or output escaping suggests an exploitation path is straightforward if the plugin is reachable from the internet.