Improper neutralization of input during web page generation allows an attacker to inject malicious JavaScript that is reflected back into the victim’s browser. This reflected XSS flaw can lead to session hijacking, credential theft, defacement, or the execution of arbitrary client‑side code, thereby compromising the confidentiality and integrity of site visitors.

The Ultimate WordPress Toolkit – WP Extended plugin (WP Extended) is vulnerable in all releases up to and including 3.0.14. Any WordPress site that has an affected version of this plugin installed is exposed to the reflected XSS risk.

The CVSS score of 7.1 indicates a moderate‑to‑high severity vulnerability, while the EPSS score of less than 1% suggests a low but nonzero probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting a malicious URL or form that includes attacker‑controlled input; when a user follows the link or submits the form, the injected script executes in the victim’s browser. Because the attack vector requires user interaction, it is primarily a web‑based threat.