The vulnerability is an improper neutralization of input during web page generation that allows a reflected XSS flaw. An attacker can inject malicious script into the web page that is executed in the victim’s browser. The attack can lead to credential theft, session hijacking, or defacement of the site. The weakness corresponds to CWE‑79, a classic XSS issue.

The affected product is the WordPress Hospital Management System plugin by mojoomla. All releases up to and including version 47.0 as released on 20‑11‑2023 are vulnerable. No specific patch version is listed in the description, so any newer release beyond 47.0 should be used if available.

The CVSS score of 7.1 indicates a Moderate‑High impact, while the EPSS score of less than 1% shows a very low likelihood of exploitation at the time of this analysis. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a reflected XSS scenario where an attacker crafts a URL or submits input that is echoed back in a page without proper escaping, which the victim subsequently follows. The attack does not require prior authentication according to the information provided; it exploits an input that is publicly reachable.