Improper sanitization of user input in the Fix Multiple Redirects plugin allows attackers to inject malicious JavaScript that is reflected back to the victim’s browser when a crafted link is visited. This reflected XSS can lead to session hijacking, credential theft, defacement, or malicious code execution within the context of the victim’s logged‑in session.

WordPress installations that use the jurajpuchky Fix Multiple Redirects plugin with a version of 1.2.3 or earlier are vulnerable. The issue spans all releases from the initial version up to and including 1.2.3.

The CVSS score of 7.1 indicates a high severity, and the EPSS score of less than 1% suggests that the likelihood of exploitation is low at present. However, because the flaw is a reflected XSS where an attacker only needs to provide a malicious link, the likely attack vector is remote and does not require elevated privileges. The vulnerability is not listed in the CISA KEV catalog, but the potential impact warrants immediate attention, especially on sites with high traffic or where the plugin processes external input.