The Dot html,php,xml etc pages WordPress plugin contains an improper neutralization of input during web page generation. An attacker can supply crafted data that is reflected back into the page without proper encoding, leading to a reflected XSS vulnerability as described by CWE‑79. The vulnerability can allow execution of arbitrary scripts in the victim’s browser, potentially capturing credentials or performing actions on behalf of the user.

Affected systems include any WordPress installation that has the karimmughal Dot html,php,xml etc pages plugin at version 1.0 or earlier. The naming indicates that all releases from the earliest available through version 1.0 are vulnerable; no later versions are mentioned as fixed.

The CVSS score of 7.1 highlights a significant impact, while the EPSS score of less than 1% suggests a low current probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit the flaw by crafting a URL or form input that the plugin echoes back to a visitor, so the likely attack vector is via reflected input in a web page that the user views. The exploit does not require authentication and can be performed over HTTP or HTTPS.