An input‑validation flaw lets an attacker inject malicious script into the page that is returned to the visitor. When a user requests a page that includes unsanitized data from the Raptive Ads plugin, the script is executed in the victim's browser. This reflected XSS can be used to steal session cookies, deface the site, or redirect users to phishing pages. The flaw is the typical Cross‑Site Scripting weakness where output is not properly neutralized.

WordPress sites that use the Raptive Ads (adthrive‑ads) plugin, versions up to and including 3.8.0, are affected. The vulnerability applies to all installations of that plugin regardless of the hosting environment, as the flaw exists in the plugin code itself and is triggered by user‑supplied input.

The CVSS score of 7.1 indicates high impact, while the EPSS score of less than 1% suggests that exploitation is currently rare. The flaw is not listed in CISA's KEV catalog, and no active exploit is publicly documented. Nevertheless, because reflected XSS can be triggered by a crafted URL, a potential attacker could embed malicious links in external content or social media to reach unsuspecting visitors.