An improper neutralization of input during web page generation allows reflected cross‑site scripting. The attacker can embed malicious JavaScript that executes in the victim’s browser, potentially stealing session cookies, tampering with data, defacing the site, or redirecting to phishing pages. This vulnerability is classified as CWE‑79 and can compromise confidentiality, integrity, and user trust for any user who visits a crafted URL.

WordPress sites that have the Saleswonder Team: Tobias WP2LEADS plugin version 3.5.0 or older installed are affected. The vulnerability applies to all instances of this plugin regardless of WordPress configuration. No other WordPress core or third‑party components are mentioned as affected.

The CVSS score of 7.1 indicates a high severity, yet the EPSS score of less than 1% suggests the likelihood of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog, and no active public exploits have been reported. The likely attack vector is an HTTP request containing unsanitized parameters that the plugin echoes back to the browser; a malicious link or form submission can deliver the payload to a victim’s browser when they click or submit data.