This vulnerability is a reflected cross‑site scripting flaw in the Hive Support plugin for WordPress. Improper neutralization of user input allows an attacker to embed JavaScript that the plugin echoes back in the page, enabling the execution of arbitrary code in the context of any user who views the crafted URL. The potential impact includes session hijacking, defacement, and drive‑by malware delivery.

The affected component is the Hive Support plugin for WordPress, specifically versions 1.2.5 and earlier. Any WordPress installation that has this plugin installed and not yet upgraded is susceptible; the plugin itself is identified by the vendor name Hive Support.

The rule‑based CVSS score is 7.1, reflecting a high‑severity vulnerability, while the EPSS score is below 1%, indicating limited current exploitation probability but not zero. It is not listed in the CISA KEV catalog. An attacker can create a malicious URL containing the unsanitized query parameter, and a victim who follows the link or clicks a social‑engineering link will have the script executed in their browser. The attack vector is therefore a remotely exploitable reflected XSS that requires user interaction.