The WP Dynamic Links plugin, by Soflyy, contains an improper neutralization of input that is reflected back to users' browsers. The flaw permits injection of malicious scripts into the page output, enabling attackers to execute arbitrary JavaScript on the victim's browser. The official CVE description only specifies a reflected XSS vulnerability; no further implications such as session hijacking, data theft, phishing or defacement are explicitly stated. The likely attack vector is delivery of malicious script via reflected parameters as described.

The vulnerability exists in all releases of the Soflyy WP Dynamic Links plugin up through version 1.0.1, which is installed on WordPress sites that include this plugin.

With a CVSS score of 7.1 the flaw is classified as medium to high severity, yet the EPSS score of less than 1% indicates a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is delivery of a crafted URL or form input that is reflected by the plugin; the attack vector is indirect and depends on victim interaction, with no authentication or privilege escalation needed.