The xPromoter plugin for WordPress fails to properly neutralize user input when generating web page content, allowing attackers to inject malicious scripts that execute in a victim’s browser through a crafted URL. This reflected cross‑site scripting flaw can lead to session hijacking, credential theft, and manipulation of the page DOM, thereby compromising user data and compromising the appearance and functionality of the site. The vulnerability is a direct consequence of improper input validation in the plugin’s handling of query parameters.

The vulnerability affects the LambertGroup xPromoter top_bar_promoter WordPress plugin, versions 1.3.4 and earlier. Any WordPress installation that has this plugin enabled before the release of a fixed version is exposed. The issue resides in the plugin’s front‑end code that echoes user input without proper escaping.

The CVSS base score of 7.1 indicates a medium‑to‑high severity. An EPSS score of less than 1% points to a currently low exploitation probability, and the flaw is not listed in CISA’s KEV catalog. Nevertheless, as a reflected XSS, it can be triggered remotely via a crafted link that a user might click, resulting in theft of session cookies or other sensitive data. The attack vector is straightforward: send a malicious URL to a victim, and if the victim visits it, the injected script runs in their browser.