An attacker can inject malicious scripts into web pages served by the Hello Followers plugin due to improper neutralization of input during page generation. The flaw enables reflected XSS, allowing the attacker to execute arbitrary JavaScript in the context of a victim's browser. This can lead to session hijacking, credential theft, or defacement of the affected site. The weakness corresponds to CWE‑79.

The vulnerability exists in the Hello Followers plugin for WordPress, sold by appscreo, across all releases up to and including version 2.5. The affected code allows reflected XSS in any input handling rendered in the front‑end, such as follower URLs or messages. Current installations of the plugin older than 2.6 are potentially exposed. No specific sub‑version details are provided beyond the upper bound.

The CVSS base score is 7.1, which indicates a high severity risk. EPSS is below 1 %, showing a low probability of active exploitation at this time, and the flaw is not listed in the CISA KEV catalog. Nevertheless, the low EPSS does not eliminate the risk for sites that remain vulnerable. The likely attack vector is a reflected XSS scenario where an attacker crafts a malicious URL or form submission that a visitor clicks or submits, causing the browser to execute the injected code.