This vulnerability is an improper neutralization of input during web page generation, identified as CWE‑79, that enables reflected XSS. When a user visits a maliciously crafted URL or submits malicious data to Slide Puzzle, the plugin outputs the input back to the page without proper escaping. An attacker could then run arbitrary JavaScript in the victim’s browser, which could be used to hijack the session, steal cookies, or deface the site.

The affected product is colome Slide Puzzle, any release from the earliest available through version 1.0.0. No higher versions are known to be affected.

The CVSS score of 7.1 indicates a high severity, but the EPSS score of less than 1% and its absence from the CISA KEV catalog suggest a low likelihood of active exploitation at this time. Attackers would likely need to lure a user to a crafted link or inject data into a form that the plugin reflects, which is a typical web‑based attack vector. Although current exploitation probability is low, the impact of a successful exploit is significant for sites that rely on the plugin.