Improper neutralization of user input during web page generation allows an attacker to inject arbitrary JavaScript into the page. This reflected XSS flaw can be used to hijack user sessions, steal credentials, deface content, or launch phishing attacks, thereby compromising the confidentiality, integrity, and availability of the affected site. The weakness is identified as CWE‑79.

The vulnerability affects any WordPress site running the PickPlugins Question Answer plugin version 1.2.70 or earlier. The issue is present in all installations of the plugin prior to version 1.2.71.

The CVSS score of 7.1 indicates a high severity level. The EPSS score of less than 1% suggests that exploitation is currently unlikely but not impossible, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted request that includes malicious input in a query string or form field processed by the plugin, causing the malicious script to be reflected in the response.