An improper neutralization of input during web page generation (Cross‑Site Scripting) is present in the xili‑dictionary WordPress plugin. Attackers can embed malicious scripts that are reflected back to a visitor’s browser when the page is rendered, enabling execution of code in the context of the site’s users. The flaw falls under CWE‑79.

The vulnerability affects the Michel‑xiligroup dev xili‑dictionary plugin for WordPress, all releases up to and including version 2.12.5.2. Any WordPress site that has this plugin installed and hasn’t upgraded beyond that version is potentially exposed.

The CVSS score of 7.1 marks this as a high‑severity issue, while an EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can remote‑trigger the reflected XSS by crafting a malicious URL or input that the plugin processes, requiring the victim to visit a crafted link or interact with the plugin’s page.