The vulnerability in the i3geek BaiduXZH Submit plugin allows attackers to inject arbitrary JavaScript into web pages that are displayed to users. This reflected XSS flaw can enable session hijacking, phishing attacks, or other malicious actions executed within the victim’s browser. The flaw arises from improper neutralization of user‑supplied input during the page rendering process, as listed under CWE‑79.

WordPress sites that have installed the i3geek BaiduXZH Submit (百度熊掌号) plugin version 1.4.6 or earlier are impacted. The vulnerability is not limited to a specific deployment environment but applies to all installations where the plugin’s input fields are accessible.

The CVSS score of 7.1 indicates a moderate severity, and the EPSS score of <1% suggests that commercial exploitation is currently unlikely. The vulnerability is not referenced in the CISA KEV catalog. Based on the description, the likely attack vector is remote: an attacker can supply crafted input via a supplied URL or form field that is reflected back to a victim’s browser, enabling the execution of malicious scripts.