The Sello ChannelConnector plugin contains a reflected cross‑site scripting flaw that allows attackers to inject arbitrary scripts into web pages viewed by users. If an attacker can craft a URL that includes malicious payload, any user who visits that link will have the script executed in their browser, potentially hijacking sessions, stealing credentials, or defacing the site. This vulnerability arises from improper sanitization of user input during web page generation and is classified as CWE‑79.

WordPress sites that have the Sello ChannelConnector plugin installed at versions 1.6.3 or earlier are affected. The plugin is distributed by selloio under the name Sello ChannelConnector. No later versions are listed as vulnerable.

The CVSS score for this flaw is 7.1, indicating a high severity level. The EPSS score is below 1 %, suggesting a low exploitation probability in the current threat landscape, and the vulnerability is not listed in the CISA KEV catalog. However, because XSS can be triggered by a crafted link and does not require privileged access, the attack vector is potentially reachable in public‑facing content such as comments, search queries, or plugin settings.