Improper neutralization of user input during page generation in the Arefly Delete Post Revision plugin allows attackers to inject malicious JavaScript that is reflected back to the browser. This reflected XSS flaw (CWE‑79) can execute arbitrary scripts in the victim’s browser context, potentially manipulating page content, capturing session cookies, or performing unauthorized actions on behalf of the victim. The vulnerability exists due to lack of output encoding when handling plugin parameters, enabling direct execution of an attacker‑controlled payload if a vulnerable URL is accessed.

The affected product is the Delete Post Revision plugin developed by Arefly, with all versions from the first release up to and including 1.1 susceptible. Users running any version <= 1.1 of this WordPress plugin should be aware of the risk.

The CVSS score of 7.1 classifies this as high severity, while the EPSS score of < 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Based on the description, the likely attack vector involves an attacker crafting a malicious URL or parameter that is reflected in the plugin’s output; an authenticated or unauthenticated user clicking the link would be required for the exploit to trigger.