WordPress users running the xili‑language plugin versions up to 2.21.2 face a reflected cross‑site scripting flaw. The plugin fails to neutralize incoming data that is later rendered in a web page, allowing an attacker to embed JavaScript. This flaw enables the execution of malicious scripts within the victim’s browser, potentially allowing credential theft or session hijacking. The vulnerability is a classic injection weakness (CWE‑79).

The affected product is the xili‑language WordPress plugin developed by Michel – xiligroup dev. All releases from the first public release through 2.21.2 are vulnerable; based on the description, it is inferred that version 2.22 and later contain the fix.

The CVSS score of 7.1 indicates high severity, but the EPSS score of less than 1 % suggests a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a crafted HTTP request that passes malicious data to the plugin, typically via a crafted URL. The attack vector is inferred to be a reflected XSS through query parameters, which an attacker can lure victims to via phishing or malicious links. Once a user loads the affected page, the injected script runs with the privileges the user has on the site.