The flaw is an improper neutralization of user input during web page generation, allowing an attacker to inject malicious JavaScript that is reflected back to the browser. If an impacted user clicks a crafted link or visits a page containing the injected payload, the script executes in the victim’s browser context, enabling phishing, credential theft, or session hijacking. The vulnerability does not grant direct server‑side code execution or privilege escalation, but it can be leveraged to compromise the confidentiality and integrity of the end‑user’s session.

WordPress users running the WSAnalytics plugin from vendor Shiva, version 1.1.2 and earlier are vulnerable. The issue affects all releases up to and including 1.1.2 regardless of other configurations.

The CVSS score is 7.1, indicating a high‑severity client‑side flaw. The EPSS score is less than 1%, suggesting a low probability of widespread exploitation at present. The vulnerability is not listed in CISA KEV. Exploitation requires an attacker to supply a malicious URL or form input that is rendered without proper escaping; it typically depends on user interaction (e.g., clicking a link).