The Arconix FAQ plugin contains an improper neutralization of input that leads to a reflected cross‑site scripting vulnerability. Because malicious data can be injected and executed in the browser when the plugin outputs user supplied content without proper encoding, an attacker can manipulate the client side of a site that uses this plugin. The flaw is identified as CWE‑79 and presents a risk to the confidentiality and integrity of any data accessed by the victim’s browser.

All installations of the TycheSoftwares Arconix FAQ WordPress plugin with a version equal to or older than 1.9.5 are affected. Sites that embed this plugin and expose the reflected input parameters are potentially vulnerable.

The vulnerability has a CVSS score of 7.1, placing it in the medium‑high severity band. The EPSS value of less than 1% indicates a very low probability of exploitation at the time of analysis. It has not been catalogued in CISA’s KEV list. The typical exploitation path would involve an attacker crafting a link or form that passes malicious payloads to the plugin, requiring the victim to interact with that content in order for the script to execute.