The vulnerability is an improper neutralization of user input during web page generation that allows an attacker to inject arbitrary scripts that execute in the browser of users who view the affected page. This reflected Cross‑Site Scripting can be used to steal session cookies, hijack accounts or perform phishing attacks. The weakness originates from the OTP‑less one tap Sign in plugin failing to sanitize query parameters before rendering them.

All installations of the OTP‑less one tap Sign in plugin with a version number less than or equal to 2.0.58 are affected. The product is provided by the vendor OTP‑less, and no earlier baseline version specification is given.

The CVSS score of 7.1 indicates a moderate‑to‑high severity, while the EPSS score of less than 1% suggests that the probability of exploitation in the wild is currently low but not negligible. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an endpoint that reflects user‑controlled input, and an attacker can supply a crafted URL or form input to trigger the script. Typical attack vectors involve the attacker sending the victim a malicious link that contains the exploitation code.