The Echo RSS Feed Post Generator Plugin for WordPress contains an improper neutralization of input during web page generation that allows attackers to inject arbitrary client‑side scripts. This reflected Cross‑Site Scripting flaw (CWE‑79) can lead to cookie theft, session hijacking, defacement of pages, or the execution of malicious code in the victim’s browser, thereby compromising confidentiality and integrity for users who view affected pages.

CodeRevolution’s Echo RSS Feed Post Generator Plugin for WordPress, versions from the initial release up to and including 5.4.8.1. Any installation of this plugin that has not been updated beyond 5.4.8.1 is vulnerable.

The CVSS base score of 7.1 indicates a high severity vulnerability with moderate complexity, and the EPSS score of less than 1% suggests that the likelihood of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a reflected XSS via crafted URLs or form submissions that leverage the plugin’s input handling, allowing an unauthenticated attacker to insert malicious scripts into a page served to other users.