Improper neutralization of input during web page generation leads to a reflected cross‑site scripting (XSS) vulnerability. The flaw allows an attacker to inject code that runs in the user’s browser, potentially enabling session hijacking, defacement or phishing attacks. The weakness stems from missing output encoding and is catalogued as CWE‑79.

The cornfeed WP‑jScrollPane WordPress plugin, versions up to and including 2.0.3, is affected. The vulnerability applies to all releases from the initial version through 2.0.3.

The CVSS score of 7.1 indicates a high severity. The EPSS score of less than 1% implies a low current exploitation probability, and the issue is not listed in CISA’s KEV catalog. Likely attack vectors are reflected via crafted URLs or form inputs that are returned without proper encoding, so any user clicking on a malicious link could be impacted. Exploitation requires no authentication and can be performed against public HTTP endpoints.