The vulnerability is an Improper Neutralization of Input during Web Page Generation (Cross‑Site Scripting). An attacker can inject malicious JavaScript that is executed in the victim’s browser when the affected parameter is reflected back into the page. This can lead to theft of session cookies or arbitrary execution of scripts in the user’s context, potentially compromising account data or enabling phishing. The flaw is identified as CWE‑79.

WordPress plugin WP Cleaner (jiangmiao) – versions up to and including 1.1.5 are affected. All installations of the plugin in this range are susceptible; later versions are not listed as vulnerable.

The CVSS score of 7.1 classifies the vulnerability as high severity, yet the EPSS score of <1% indicates a very low probability of exploitation at present. Because the attack vector is reflected XSS, an attacker only needs to craft a link containing the malicious payload and get a victim to visit it, which is feasible via social engineering or malicious emails. The vulnerability is not currently listed in the CISA KEV catalog, further suggesting limited active exploitation. System owners should therefore treat the flaw as high risk with moderate likelihood of exploitation, especially if the plugin is exposed to public users.