The vulnerability resides in the David Wood Latest Custom Post Type Updates plugin when used in versions 1.3.0 or earlier. Improper neutralization of user input during web page generation permits attackers to inject malicious scripts that are reflected back to the victim's browser. This can lead to session cookie theft, defacement, or other client‑side compromise. The weakness is classified as CWE‑79.

WordPress sites running the Latest Custom Post Type Updates plugin version 1.3.0 or older are vulnerable. The affected product is the David Wood plugin that manages custom post types for the site.

The CVSS base score of 7.1 indicates a high severity. The EPSS score is below 1%, implying a low probability of widespread exploitation at the moment, and the vulnerability is not currently listed in CISA’s KEV catalog. Based on the description, the attack vector is likely remote via harmless crafted URLs or forms that trigger the reflected content, though the exact path is not explicitly defined in the advisory; it is inferred that any user who visits a crafted link could trigger the vulnerability.