The vulnerability is an Improper Neutralization of Input During Web Page Generation, allowing attackers to inject arbitrary script via reflected input; it is a classic reflected XSS (CWE‑79). This flaw can potentially steal cookies, hijack sessions, or execute unauthorized actions within the victim’s browser by reflecting untrusted data back to the page without proper sanitization.

Grid Plus plugin for WordPress, distributed by G5Theme. All releases from the earliest available version up to and including 3.3 are affected; versions 3.4 and later are presumed to contain the fix.

The CVSS score of 7.1 indicates moderate severity, while the EPSS score of less than 1% shows a very low current exploitation probability and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the injection of malicious script via a crafted URL or form field that is reflected back into the page, requiring only that the victim visit the link or submit the payload. No additional privileges or vulnerabilities are required, so the risk is limited to user interactions and client‑side compromise.