The Category Widget plugin for WordPress contains a reflected Cross‑Site Scripting flaw that arises from improper neutralization of user input when the widget renders on a page. This vulnerability, classified as CWE‑79, allows an attacker to supply malicious content that is echoed back to the browser, potentially executing arbitrary JavaScript within the victim’s session context. While the impact is limited to the widget’s output page, any user who loads a crafted URL can be compromised, exposing session data, enabling defacement, or allowing data theft.

All installations of the Category Widget plugin from its original release through version 2.0.2, distributed by M A Vinoth Kumar, remain vulnerable. No specific post‑2.0.2 releases are mentioned in the CVE, so any site running 2.0.2 or an earlier version should be treated as at risk.

The CVSS score of 7.1 marks this flaw as high severity, while the EPSS score of less than 1% suggests exploitation attempts are uncommon but still possible. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be user‑initiated via a crafted URL that injects malicious payloads into the widget output. Although active exploitation is unlikely given the low EPSS, the potential for significant user compromise remains.