The vulnerability manifests as an improper neutralization of input during web page generation, allowing reflected cross‑site scripting attacks. An attacker can inject malicious JavaScript into the page output, potentially executing code in the context of an authenticated user, stealing session cookies, or defacing content. The weakness is classified as CWE‑79.

The affected product is the WordPress WP Hide Categories plugin developed by Huseyin Berberoglu. Versions from n/a through 1.0 are impacted; any site running the plugin at or below version 1.0 is vulnerable.

The CVSS score is 7.1, indicating a high severity level. The EPSS score is less than 1 %, suggesting a low likelihood of widespread exploitation at present. The issue is not listed in the CISA KEV catalog, though the vulnerability is still actionable. Attackers would need to persuade a user to visit a crafted URL containing malicious payloads; the primary attack vector is through a reflected XSS exposed by the plugin’s handling of user input.