The vulnerability is a reflected XSS flaw caused by improper neutralization of input when generating pages in the redqteam Wishlist WordPress plugin. Unescaped data supplied by an attacker is reflected back into the HTML, allowing scripts to run in a visitor’s browser. This can lead to session hijacking, phishing, defacement, or the execution of malicious code. The issue is classified as CWE‑79.

All WordPress sites that use the redqteam Wishlist plugin version 2.1.0 or earlier are affected. The flaw is present in every release from the plugin’s inception up to and including 2.1.0, and no additional platform constraints are listed.

The CVSS score of 7.1 signals a high‑severity vulnerability, but the EPSS score of < 1% indicates a low probability of exploitation in the wild. The vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector is a web‑based reflected XSS, where an attacker crafts a malicious URL or form input that the plugin fails to sanitize. If a user visits a site containing the vulnerable plugin, the malicious code is executed in the context of that site’s domain.