The vulnerability is a reflected XSS that occurs when the plugin fails to properly neutralize user input before rendering it in a webpage. Because the flaw belongs to CWE‑79, an attacker can inject arbitrary scripts that will be executed in the victim’s browser when the page containing the malicious query parameter is accessed. This can lead to session hijacking, defacement, or the execution of malware via the victim’s browser. The impact is limited to the user’s session and does not provide server‑side code execution.

The vulnerability affects the AEC Kiosque WordPress plugin from any version up to and including 1.9.3. All installations of the plugin version 1.9.3 or older are vulnerable, regardless of site configuration.

The CVSS score of 7.1 indicates a moderate to high risk level, but the EPSS score of less than 1% suggests a low likelihood of exploitation in the near term. The vulnerability is not recorded in the CISA KEV catalog. The likely attack vector is a crafted URL or form input that is reflected by the plugin’s output, requiring no special authentication. An attacker who succeeds can execute client‑side scripts but cannot directly affect the server.