The vulnerability originates from improper neutralization of input in the Doliconnect WordPress plugin, allowing a reflected XSS injection. An attacker can embed malicious JavaScript that executes in the browser of any visitor who opens a crafted link or input that triggers the flaw. This can lead to theft of session cookies, credential hijacking, or defacement of the user’s browser experience. The weakness is a classic reflected cross‑site scripting flaw, classified as CWE‑79.

The flaw affects ptibogxiv’s Doliconnect plugin for WordPress from the earliest release through version 9.3.2. Any WordPress site running the plugin in that version range is potentially vulnerable. No other products or versions were noted.

The CVSS score of 7.1 indicates moderately high risk, while the EPSS score of less than 1% shows that historical exploitation likelihood has been very low. The flaw is not listed in the CISA KEV catalog. The attack vector requires user interaction with a crafted URL or input that is reflected without proper escaping, causing the injected script to run in the victim’s browser.