The vulnerability is an improper neutralization of input during web page generation that allows reflected cross‑site scripting. An attacker can supply crafted data that the Syndicate Out plugin reflects directly into a generated page, enabling execution of arbitrary JavaScript in the browser of any user who views the affected page.

WordPress plugin Syndicate Out, created by confuzzledduck, is affected for all releases up to and including version 0.9.

The CVSS score is 7.1, indicating a high severity, while the EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting a lower probability of exploitation. The likely attack vector is via web input that the plugin reflects without proper sanitization, which requires an attacker to craft a malicious URL or payload that a victim’s browser will process.