An attacker can craft a malicious URL that injects script code into the SERPed.net plugin’s response. Because the plugin does not neutralize user input before rendering, reflected cross‑site scripting occurs. This flaw can allow execution of arbitrary JavaScript in a user’s browser, leading to credential theft, session hijacking, or defacement. The weakness is identified as CWE-79.

The vulnerability is present in the WordPress SERPed.net plugin supplied by the SERPed.net vendor. Any site running a version of SERPed.net up to and including 4.6 is affected. No other products are listed.

The CVSS score indicates high severity (score 7.1), but the EPSS score of less than 1% suggests a low probability of being exploited in the wild at present. The flaw is not listed in the CISA KEV catalog, indicating it has not yet been widely used. The likely attack vector is remote: an attacker can send a crafted link to a vulnerable user, who opens it in a browser and executes the injected script. No authentication is required; the vulnerability is exploitable via a reflected request.