The Post Connector plugin for WordPress fails to neutralize user-supplied input in the pages it generates. This reflected XSS flaw would let an attacker embed malicious script into a response that is immediately displayed to the victim user after following a crafted link or submitting a form. The injected code could steal credentials, hijack sessions, or alter page content. The vulnerability is a standard input validation flaw classified as CWE-79.

Barry Kooij:Post Connector plugin for WordPress. Versions from the initial release up to and including 1.0.11 are affected. Any site running the plugin in these versions is vulnerable.

The CVSS score of 7.1 indicates a high severity with potential for significant impact, though the EPSS score below 1 % shows a very low probability of exploitation at present. The flaw can be triggered via a specially crafted request containing script code, typically delivered through a URL or form submission. Because the vulnerability is reflected, it requires a victim to open a malicious link or submit a form, making it a targeted threat that can be mitigated by updates and input sanitization.