The XV Random Quotes plugin contains a flaw where data supplied by users is not properly neutralized before being rendered into web pages. This vulnerability permits reflected XSS, allowing an attacker to inject and run malicious scripts in a victim’s browser when the plugin processes a crafted request. The consequence is that code runs in the victim’s browser context, potentially exposing session information or manipulating page content.

This issue affects installations of Xavi Ivars' XV Random Quotes plugin with a version number no higher than 2.0.0. WordPress sites that have the plugin in any of these releases are potentially vulnerable and should verify the installed version.

The CVSS base score of 7.1 indicates a moderate to high severity, while the EPSS score of less than 1 % suggests a low current likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. According to the description, the likely attack vector involves an attacker crafting HTTP requests that embed malicious scripts into parameters processed by the plugin; the attacker would need a victim to visit such a URL. The flaw does not require privileged access beyond triggering the page load.