Technical impact
WordPress users running the xili‑language plugin versions up to 2.21.2 face a reflected cross‑site scripting flaw. The plugin fails to neutralize incoming data that is later rendered in a web page, allowing an attacker to embed JavaScript. This flaw enables the execution of malicious scripts within the victim’s browser, potentially allowing credential theft or session hijacking. The vulnerability is a classic injection weakness (CWE‑79).
Affected Systems
The affected product is the xili‑language WordPress plugin developed by Michel – xiligroup dev. All releases from the first public release through 2.21.2 are vulnerable; based on the description, it is inferred that version 2.22 and later contain the fix.
Risk and Exploitability
The CVSS score of 7.1 indicates high severity, but the EPSS score of less than 1 % suggests a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a crafted HTTP request that passes malicious data to the plugin, typically via a crafted URL. The attack vector is inferred to be a reflected XSS through query parameters, which an attacker can lure victims to via phishing or malicious links. Once a user loads the affected page, the injected script runs with the privileges the user has on the site.
EUVD