The Raptive Ads WordPress plugin implements a reflected XSS flaw due to inadequate sanitization of user‑supplied input. An attacker can craft a malicious URL that contains arbitrary JavaScript; when a victim opens this URL the script runs inside the victim’s browser context. This can result in theft of session cookies, defacement of the site, or redirection to phishing domains, thereby compromising the confidentiality, integrity, and availability of the affected system for users.

Any WordPress site that has the Raptive Ads (adthrive-ads) plugin installed at or below version 3.7.3 is vulnerable. The flaw exists in all releases from the initial distribution onward through 3.7.3, distributed by Raptive.

The CVSS score of 7.1 denotes medium severity, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalogue, suggesting no known active attacks. Exploitation requires a victim to click or otherwise load the crafted URL, making it a user‑interaction based attack that does not need privileged server access but can be used in social‑engineering campaigns to compromise user sessions or inject malicious content.