The vulnerability is a reflected Cross‑Site Scripting (XSS) flaw in the WP Wizard Cloak plugin that allows an attacker to inject malicious scripts into pages served to users. This can lead to theft of session cookies, credential hijacking, defacement of content, or redirection to phishing sites, thereby compromising user confidentiality and the integrity of the website. The weakness arises from improper neutralization of user input during page rendering and is catalogued as CWE‑79.

The flaw affects the WP Wizard Cloak plugin sold by Soflyy for WordPress sites. Versions up to and including 1.0.1 are impacted. Any WordPress site running those versions is potentially vulnerable.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a reflected XSS via crafted URL parameters or form input that the plugin fails to sanitize, requiring an end‑user to load a malicious link or enter malicious data.