The flaw allows an attacker to inject and execute arbitrary JavaScript in a victim’s browser when malicious input is reflected back in the response. This results in client-side script execution that can compromise the confidentiality and integrity of the user session. While the CVE entry does not enumerate specific downstream exploits, reflected XSS in a WordPress plugin can enable a range of client-side attacks.

WordPress installations that use the Labib Ahmed Team Builder plugin up to and including version 1.3. The issue exists in the plugin’s team-display component and affects all sites that have this plugin enabled, regardless of other WordPress or plugin configurations.

The CVSS score of 7.1 rates the vulnerability as high severity. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The attack operator does not need special prerequisites beyond creating a malicious request that includes the reflected input; based on the description, it is inferred that the likely attack vector is through normal page rendering when a user follows a crafted URL. The vulnerability can be triggered simply by directing a user to a malicious link that passes untrusted data to the vulnerable component.