The Popping Content Light plugin for WordPress contains an improper neutralization of input during web page generation, allowing a reflected cross‑site scripting attack. An external user can provide specially crafted input that is echoed back in the page, enabling the execution of arbitrary client‑side scripts. This flaw can be used to alter the displayed content or interact with the site in unintended ways.

The vulnerability affects any installation of the OTWthemes Popping Content Light WordPress plugin version 2.4 and earlier, including all releases from the earliest build up to and including 2.4.

The CVSS score of 7.1 indicates a medium‑to‑high severity level. The EPSS score of less than 1% suggests the probability of exploitation is very low. The vulnerability is not listed in CISA KEV. The likely attack vector is a web‑based user accessing a malicious URL or input field that is reflected by the plugin, which requires the victim to load the crafted content in a browser. The overall risk is significant for sites that expose the plugin to external users, but the likelihood of exploitation remains low based on current evidence.