This vulnerability is an instance of Improper Neutralization of Input During Web Page Generation, classified as CWE‑79. The insecure handling of user‑supplied data allows an attacker to inject malicious scripts that are reflected in the webpage response. Such scripts can be executed in the context of the victim’s browser, enabling cookie theft, session hijacking, defacement, or other client‑side attacks.

WordPress installations that have the Wptobe‑signinup plugin (wptobe:Wptobe‑signinup) version 1.1.2 or earlier are affected. The vulnerability exists throughout the listed range from an undefined initial revision up to and including version 1.1.2.

The CVSS score of 7.1 indicates high severity, while an EPSS score of less than 1% suggests a low probability of active exploitation in the near term. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to craft a URL or input that the plugin reflects in the page output, forcing the victim to visit the malicious link or otherwise trigger the payload. The attack vector is therefore reflected XSS, typically achieved through social engineering or compromised intermediaries.