The vulnerability is an improper neutralization of user input during web page generation, allowing an attacker to inject and execute arbitrary JavaScript in the context of a victim’s browser. This reflected XSS can be used to steal session cookies, deface webpages, or phish for credentials, thereby compromising confidentiality and user trust. The weakness is identified as CWE‑79.

WordPress sites that have the Control Listings plugin by Habibur Rahman Razib installed in any version up to and including 1.0.4.1. No other vendors or products are listed as affected.

The CVSS score of 7.1 indicates high severity, yet the EPSS score of less than 1 % shows that exploitation is unlikely at present. The vulnerability is not currently listed in CISA’s KEV catalog. Access would require the attacker to craft a URL or form submission that includes malicious input, which is then reflected by the plugin without proper escaping. Because it is a reflected XSS, the attack vector is via a URL or input field that users may not see but can be tricked into visiting or submitting, making it a typical client‑side exploitation scenario.