The vulnerability is an improper neutralization of input that allows a reflected XSS attack. The plugin fails to escape user supplied data from the search query before rendering it in the page output. Attackers can inject JavaScript that executes in the context of any visitor who views the results of the search request. This flaw satisfies CWE‑79 and can lead to session hijacking, defacement, or the execution of arbitrary code in the victim's browser.

WordPress sites that install the Sound Strategies SoundSt SEO Search plugin version 1.2.3 or earlier are affected. The vulnerability operates across all installations where the search functionality is exposed, regardless of the site's domain or theme.

With a CVSS score of 7.1 the flaw is considered a high‑severity problem. The EPSS score of < 1% indicates that the probability of exploitation is low, and the flaw is not currently listed in the CISA KEV catalog. The likely attack vector is reflected input via the search form; an attacker can craft a URL containing malicious payloads that are displayed without sanitization. If the site allows unauthenticated users to trigger the search query, the vulnerability is exploitable by anyone visiting the site.