The vulnerability is an improper neutralization of user input during web page generation, allowing attackers to embed malicious scripts that are executed by other users' browsers. A successful exploit can lead to theft of session cookies, defacement of content, and the potential for further phishing or credential harvesting attacks. The weakness is a classic reflected XSS flaw, classified as CWE‑79.

The affected element is the WordPress plugin Bulk Page Stub Creator developed by runthings.dev. All releases from the initial version through version 1.1 are vulnerable and must be replaced or updated.

The CVSS score of 7.1 places this issue in the High severity range. The EPSS score indicates a very low probability of public exploitation (< 1 %), and it is not currently listed in the CISA KEV catalog. The likely attack vector is a malicious URL that includes injected payloads targeting the plugin’s parameter handling, which can be delivered via social engineering or malformed links.