Improper neutralization of input during web page generation in the xili‑dictionary plugin allows a reflected cross‑site scripting vulnerability. The flaw permits an attacker to inject and execute arbitrary client‑side script in the victim’s browser when a crafted URL or form is loaded. This breach of the page’s output encoding enables malicious JavaScript code to run with the context of the site.

The vulnerability affects WordPress sites using the Michel - xiligroup dev xili‑dictionary plugin version 2.12.5 or any earlier release. Any WordPress installation that has this plugin installed remains vulnerable until the component is updated beyond the specified version.

The CVSS score of 7.1 indicates a medium‑to‑high severity, while the EPSS score of less than 1 % points to a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that a typical attack scenario would involve an attacker crafting a link or form that, when a user accesses it, triggers the reflected XSS payload. Because the injected script runs in the victim’s browser, the attacker could interact with the page’s DOM and potentially capture or manipulate data visible to that user.