The vulnerability is a reflected cross‑site scripting flaw caused by improper neutralization of user input during web page generation. The flaw allows an attacker to inject malicious scripts into the pages served to users, potentially resulting in credential theft, session hijacking, or execution of arbitrary code in the victim’s browser. This is a classic improper input validation issue identified as CWE‑79.

The issue affects the WordPress Child Themes plugin developed by Chris Taylor. All releases up to and including version 1.0.1 are vulnerable; sites that have not upgraded beyond that version remain at risk.

With a CVSS score of 7.1, the vulnerability represents a high risk to affected systems. The EPSS score of less than 1% indicates that exploitation in the wild is currently rare, and the vulnerability is not listed in the CISA KEV catalogue. The attack is likely to be triggered by a crafted URL or form input that a user clicks or submits, making reflected XSS a realistic threat for any user of the vulnerable plugin.