The flaw is a reflected XSS vulnerability in the Accordion Slider PRO plugin for WordPress versions up to 1.2, stemming from improper neutralization of user supplied input before it is included in HTTP responses. An attacker could embed malicious JavaScript into a crafted request, which, when processed by the plugin, would be reflected back into the page and executed in the victim’s browser. This could lead to session hijacking, cookie theft or other browser‑based attacks. The weakness is classified as CWE‑79.

The vulnerability affects WordPress installations that have installed the LambertGroup Accordion Slider PRO plugin version 1.2 or earlier. No other vendor or product name is listed. Any site using those releases is potentially impacted until a newer, fixed version is deployed.

The CVSS base score of 7.1 indicates a high severity, but the EPSS score of less than 1% indicates a low likelihood that this flaw is being actively exploited in the wild. The vulnerability is not currently listed in the CISA KEV catalogue. Attackers would most likely need to craft a URL or form input that includes malicious payloads and convince a victim to visit or submit it, thereby enabling the reflected script to run in the victim’s browser.