The vulnerability is a reflected XSS flaw caused by the plugin’s failure to neutralize user supplied input before outputting it to the page. A malicious actor can embed arbitrary JavaScript payloads in URLs that the plugin reflects back to the browser. Successful exploitation allows arbitrary client‑side script execution in the context of the victim’s session, enabling cookie theft, session hijacking, or defacement of user pages. The weakness is classified as CWE‑79.

All installations of the Arete‑IT "Activity Reactions For Buddypress" WordPress plugin with a version number of 1.0.22 or earlier are affected. The vulnerability is present in every release from the initial release up to and including 1.0.22.

The CVSS score of 7.1 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. The attack vector is via the web application; an attacker needs only to craft a malicious URL with injected code and persuade a user to visit it. Because reflected XSS requires an interactive victim, the potential impact is limited to users who click the malicious link, but the consequences for those users can be severe if the injected script can perform privileged actions in the victim’s session.