The vulnerability is a reflected XSS flaw that occurs when user input is inserted into a page without proper neutralization. An attacker who can control the input can cause arbitrary scripts to run in the victim’s browser, potentially enabling session hijacking, credential theft, or execution of malicious code. The weakness aligns with CWE‑79, which focuses on improper input sanitization before rendering.

WordPress users running the Anything Popup plugin version 7.3 or earlier are affected. The plugin’s primary maintainer is listed as gopiplus@hotmail.com. No other vendor or product versions are reported to be vulnerable.

The CVSS base score of 7.1 labels the flaw as high severity, though the EPSS score of less than 1 % suggests low overall exploitation probability at present. The flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted payload that the plugin reflects back in a page, which is typically achieved via a crafted URL or form field. Anyone who can visit the vulnerable page can be affected, making the attack vector remote and publicly reachable.