Improper neutralization of user input allows an attacker to inject malicious script code into pages that are displayed to other users. The reflected nature of the flaw means the injected payload is echoed back within the same HTTP response, enabling the attacker to craft a URL or form that will execute arbitrary JavaScript in the victim’s browser, potentially leading to credential theft, session hijacking, or defacement.

The vulnerability exists in the Zephyr Project Manager WordPress plugin, developed by Dylan James, and affects all versions up through 3.3.101. Site owners should verify the plugin version and upgrade if possible.

The CVSS score of 7.1 indicates a moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability has not been catalogued in the CISA KEV list. Nonetheless, because reflected XSS can be leveraged from a web page, an attacker with access to any authenticated or unauthenticated vector on the host can deliver payloads via crafted URLs, so the risk remains significant for exposed sites.