The WP Voting plugin for WordPress is vulnerable to a reflected cross‑site scripting flaw caused by improper neutralization of user input. When an attacker crafts a URL or input that is reflected by the plugin, the victim’s browser will execute the supplied script. This can lead to theft of session cookies, defacement, or execution of arbitrary JavaScript.

The vulnerability exists in the Ko Min WP Voting plugin, versions up to and including 1.8. Any WordPress site that has installed WP Voting 1.8 or older is affected.

The CVSS score of 7.1 indicates a high severity. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting that active exploitation is currently rare. The likely attack vector is a reflected XSS attack via a malicious link or form submission that the victim follows or clicks. Successful exploitation requires the plugin to be active and the victim to visit a crafted page that triggers the reflected input. The impact is limited to the victim’s browser and could include data theft or manipulation of web content.