The WPAMS apartment‑management plugin for WordPress contains a reflected cross‑site scripting flaw because user‑supplied input is not properly escaped before being inserted into the generated HTML. An attacker can craft a malicious URL or form payload that includes JavaScript, which is then reflected back to the victim’s browser. This allows the attacker to run arbitrary scripts within the victim’s session, potentially hijacking credentials or defacing the site.

The vulnerability is present in all releases of the WPAMS plugin from the earliest version through version 44.0, released on 17‑08‑2023. Any WordPress site that has the affected WPAMS plugin installed is susceptible to exploitation.

The CVSS score of 7.1 indicates a moderate‑to‑high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The flaw has not been reported in the CISA KEV catalog. Attackers would likely target the web interface by inserting malicious scripts into query parameters or form fields that are reflected in the page output. If exploited, an attacker could deface the site, phish users, or steal session cookies. The lack of authentication requirement for the reflected payload means anyone who visits a crafted URL could be impacted.