The Pages Order plugin contains an improper neutralization of input during page generation, allowing attackers to inject malicious scripts into reflected responses. This CWE-79 XSS flaw can be exploited when an attacker crafts a specially constructed URL or form input that is echoed back by the plugin. Successful exploitation could enable session hijacking, defacement, or theft of user credentials, depending on the victim's browser context. The vulnerability requires the victim to visit a crafted URL, so it is an interactive flaw.

Sed Lex Pages Order plugin, versions up to and including 1.1.3. Any WordPress site that has this plugin installed and has not been patched beyond 1.1.3 is affected. The issue applies to all deployments of the plugin regardless of WordPress theme or other plugins.

The vulnerability carries a CVSS score of 7.1, indicating a high severity but not critical. The EPSS score is < 1%, suggesting a very low likelihood of exploitation in the wild at the time of reporting. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a reflected XSS scenario that requires user interaction via a crafted link or form. Exploitation is straightforward if an attacker can deliver a manipulated request to a victim's browser.