The vulnerability arises from improper neutralization of input during web page generation, permitting reflected XSS in the e‑boekhouden.nl WordPress plugin. An attacker can supply crafted user input that the plugin incorporates into the page without adequate escaping, resulting in the execution of arbitrary JavaScript in the victim’s browser.

The flaw affects the e‑boekhouden.nl WordPress plugin version 1.9.3 and all earlier releases. Users who have installed this plugin on their WordPress sites are potentially vulnerable.

The vulnerability is scored 7.1 on CVSS, indicating a high‑risk issue. The EPSS score of less than 1% suggests the probability of exploitation is low but not zero, and the vulnerability is not yet listed in the CISA KEV catalog. Based on the description it is inferred that the attack vector involves a reflected XSS attack; an adversary would need to craft a malicious link that is reflected by the plugin and obtain a victim user to visit it, allowing the execution of client‑side code and potential data exfiltration or session hijacking.