The CVE details a stored cross‑site scripting flaw originating from improper neutralization of input during page generation in the WordPress Libro de Reclamaciones plugin. An attacker can inject malicious script that will run in the browsers of any visitor to affected pages, enabling session hijacking, cookie theft, defacement or arbitrary client‑side code execution. This CWE‑79 vulnerability can compromise user confidentiality and data integrity on the site.

Affected is the WordPress plugin Libro de Reclamaciones by ivanrojas, versions from earliest released through 1.0.1 inclusive. The vulnerability was identified in all releases up to and including this version.

The CVSS score is 7.1, categorising the flaw as High severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker submitting specially crafted input through any publicly accessible form or content field that is stored and later displayed without proper sanitization. Successful exploitation would require that the target page renders the unescaped payload.