The vulnerability is an instance of improper neutralization of input during web page generation, also known as a reflected Cross‑Site Scripting (XSS) flaw in the WordPress WP2LEADS plugin. It permits an attacker to embed malicious scripts into URLs or form fields that are subsequently reflected back to a user’s browser. The injected scripts can run in the victim’s browser context whenever the crafted content is rendered.

The flaw affects the WordPress WP2LEADS plugin produced by Saleswonder Team: Tobias. All releases up to and including version 3.4.5 are vulnerable. No other vendors or products are listed as impacted.

The CVSS score of 7.1 indicates a high severity for this reflected XSS vulnerability. The EPSS score of less than 1 % suggests a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw involves client‑side input that is reflected in a server response, an attacker it by supplying crafted input—such as a malicious URL or form submission—to a user who visits or interacts with the affected page. The vulnerability does not require privileged access to the server or database; it is exercised through the user’s browser session.