The Mobile Pages plugin for WordPress contains an improper neutralization of input flaw that results in reflected cross‑site scripting. An attacker can embed malicious code that the browser executes when a victim visits a crafted URL, allowing theft of credentials, session hijacking, or arbitrary script execution. This vulnerability directly compromises confidentiality, integrity, and availability of site content for any user who views the affected page.

Sites using the pootlepress Mobile Pages plugin version 1.0.2 or earlier are affected. The flaw exists in the plugin’s input handling across all WordPress installations that include Mobile Pages up to that version.

The CVSS score of 7.1 classifies this issue as high severity. With an EPSS score below 1% and not listed in the CISA KEV catalog, exploitation is considered possible but currently rare. The likely attack vector involves an attacker creating a malicious URL containing the reflected input, which a user then sees when loading the page. Once the victim parses the page, the injected script runs with the victim’s browser privileges.