Improper neutralization of input in the Tayori Form plugin allows attackers to inject malicious scripts via user‑supplied data that is reflected back into the page. This reflected Cross‑Site Scripting vulnerability (CWE‑79) can be used to steal session cookies, deface the site, or execute arbitrary client‑side code in the victim’s browser, potentially compromising user confidentiality and enabling further attacks.

This issue affects the WordPress Tayori Form plugin in all releases from the earliest publicly available version up through 1.2.9. Any website that installs or updates the plugin to a vulnerable version is at risk.

The CVSS base score of 7.1 indicates a high‑severity vulnerability, while the EPSS score of < 1% suggests a low probability of current exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker can exploit the flaw by crafting a URL or form input containing malicious JavaScript, which will be reflected in the response of a Tayori Form page, allowing remote code execution in the context of the site’s users. Because the flaw stems from insufficient input sanitization, any user who is tricked into opening a crafted link can be affected.