The Bulk NoIndex & NoFollow Toolkit plugin fails to escape user data before rendering it into a web page. The unfiltered data is echoed back to the victim’s browser, allowing an attacker to embed JavaScript in the response. By delivering a crafted link to a user, an attacker can run arbitrary code in the victim’s context, potentially hijacking sessions, defacing site content, or redirecting the user to malicious sites.

WordPress sites that have the Bulk NoIndex & NoFollow Toolkit plugin from madfishdigital installed in a vulnerable version (≤ 2.16). The impact is on any visitor to those sites.

The CVSS score of 7.1 indicates a high severity, and the EPSS score of less than 1 % shows a low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted URL that passes unescaped input to the plugin; an attacker can lure a user to the malicious link to trigger the reflected XSS attack. No authentication is required to exploit the flaw.