This is an Improper Neutralization of Input During Web Page Generation (CWE‑79) flaw that allows a reflected XSS attack. The Silvasoft boekhouden plugin echoes user‑supplied data into web pages without proper sanitization. An attacker who can create a URL containing malicious payload can cause arbitrary JavaScript to run in the victim’s browser with the privileges of the page visitor, potentially exposing personal data or session information.

All installations of the Silvasoft boekhouden WordPress plugin with versions up to and including 3.0.6 are affected. Since the plugin is a WordPress extension, any WordPress site that has the vulnerable plugin installed is vulnerable. The issue is confined to the plugin code and does not depend on the underlying operating system or web‑server configuration.

The flaw holds a CVSS base score of 7.1, reflecting a high level of risk. The EPSS score of less than 1% indicates that current exploitation probability is low. It is not listed in CISA’s KEV catalog. Attackers would most likely exploit the vulnerability by directing a user to a crafted link that triggers the unsanitized input to be reflected, requiring no special credentials or privileged access.