The Rentsyst WordPress plugin contains a reflected XSS flaw caused by improper neutralization of user input when generating web pages. A malicious user can embed script payloads in specially crafted requests, which are echoed back in the browser output. The injected code runs in the victim’s browser context and can be used for session hijacking, credential theft, defacement, or phishing attacks. The weakness is characterized as CWE‑79 and is confined to the user‑interface layer, without compromising server or database integrity.

Vulnerable versions of the Rentsyst plugin are all releases from the earliest available version through 2.0.100 inclusive. The affected product is developed by dimafreund and installed as a standard WordPress plugin. No other components or plugins are explicitly mentioned as affected.

The CVSS score of 7.1 indicates a high severity risk, while the EPSS score of less than 1 % reflects a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by directing a victim’s browser to a crafted URL that includes malicious script content; no administrative privileges or authentication are required. Exploitation is therefore possible in the context of open links or phishing campaigns.