Clinked Client Portal, a WordPress plugin, contains a reflected cross‑site scripting flaw where user input is not properly escaped before being reflected in a page. This allows execution of arbitrary JavaScript in the victim browser when a crafted URL or input is processed by the plugin, potentially leading to defacement, phishing, or other malicious actions performed in the context of the site. Based on the description, it is inferred that an attacker could inject JavaScript to deface the site, carry out phishing, or perform other malicious actions within the site's context.

The vulnerability is present in the Clinked Client Portal plugin for WordPress in all releases up to and including 1.10. Any WordPress installation that uses the Clinked Client Portal plugin and has not upgraded beyond version 1.10 is impacted.

The CVSS score of 7.1 indicates high severity. The EPSS score is less than 1%, suggesting a low current probability of exploitation, and the vulnerability is not listed in the CISA KEV catalogue. Based on the description, it is inferred that the likely exploitation would involve a remote attacker delivering a malicious link that triggers the plugin to echo unsanitized input to the browser context.