The vulnerability is an improper neutralization of input during web page generation that allows malicious scripts to be reflected back to a user’s browser. The reflected cross‑site scripting can cause arbitrary JavaScript to execute in the victim’s session, potentially compromising application integrity and confidentiality. The description indicates no further impacts beyond the injection of malicious code.

The WP_Identicon plugin for WordPress, developed by scottsm, is affected from its earliest available version through 2.0. Any WordPress site that hosts WP_Identicon 2.0 or earlier is vulnerable, while no other WordPress plugins or core components are listed as affected.

The CVSS score of 7.1 denotes high severity, but the EPSS score of less than 1% indicates a low current probability of exploitation. The vulnerability is not included in the CISA KEV catalog. Based on the description, the likely attack vector is a crafted HTTP request that triggers the malicious payload to be reflected back in the response, affecting only the victim’s browser session.