Improper neutralization of input during web page generation allows a reflected XSS flaw in the e-plugins Directory Pro plugin. The vulnerability lets an attacker embed malicious scripts into page content that is returned to a victim’s browser, potentially enabling credential theft, session hijacking, or delivery of arbitrary malware. This weakness is identified as CWE‑79 and can affect an attacker’s ability to compromise confidentiality or integrity on visited sites.

WordPress sites that use the Directory Pro plugin version 2.5.5 or earlier are affected. The plugin is distributed by e‑plugins and installed as a WordPress component, so any site running the plugin without updates is vulnerable.

The CVSS score of 7.1 indicates moderate to high severity. The EPSS score is below 1 %, showing a very low current exploitation probability, and the issue is not listed in the CISA KEV catalog. A typical attack requires the victim to click a crafted link or submit malicious input via the plugin UI, making exploitation dependent on user interaction. Because the flaw is reflected, it can be triggered by arbitrary URLs, but does not grant direct code execution or persistence on the host.