FS Poster, a WordPress plugin, contains an improper neutralization of user input that allows attackers to embed malicious scripts in pages rendered by the plugin. This reflected XSS flaw can enable script execution in the victim’s browser, potentially leading to session hijacking, phishing, or other client‑side attacks. The weakness is classified as CWE‑79.

WordPress sites that have the FS Poster plugin installed with version 6.5.8 or earlier are affected. All earlier releases, from the initial release up to and including 6.5.8, lack the fix for this reflected XSS issue.

The vulnerability carries a CVSS score of 7.1, indicating a moderate‑to‑high risk when the plugin is exposed to the internet. The EPSS score of <1% suggests that exploit attempts are currently uncommon. The attack can be performed remotely by an attacker crafting a malicious URL or input that the plugin echoes back to the browser. Because the flaw hinges on reflected input, the attacker needs only to trick a user into visiting a malicious link or to supply dangerous data that the plugin does not sanitize.