The vulnerability is an improper neutralization of input during web page generation (CWE‑79), allowing reflected XSS in the bobbingwide oik WordPress plugin. An attacker can craft input that is echoed back into the page without proper encoding. This enables arbitrary script execution within the victim’s browser when they view the affected page, potentially compromising confidentiality, integrity, and availability of the web application for users who encounter the page.

WordPress sites that use the bobbingwide oik plugin up to and including version 4.15.2 are affected. Any deployment of the plugin in that version range must be examined; upgrading to any revision thereafter removes the known flaw.

The CVSS score of 7.1 indicates a high severity, but the EPSS score of less than 1 % suggests a low probability of active exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. It is a reflected XSS vulnerability, meaning an attacker can trigger it by supplying a crafted request that reaches the vulnerable endpoint, which typically requires no authentication. An attacker could thus execute arbitrary JavaScript in the context of the victim’s session when the biased input is reflected.