The vulnerability is an instance of improperly neutralised user input that allows attackers to embed malicious JavaScript into the page output generated by the FolioVision FV Antispam plugin. Because the plugin fails to encode or validate the incoming data, a reflected Cross‑Site Scripting flaw exists, which can enable attackers to inject arbitrary scripts that run in the context of any browser that processes the malicious response.

The FolioVision FV Antispam WordPress plugin versions up to and including 2.7 are affected. Any WordPress site that has these plugin versions installed is vulnerable, regardless of other plugins or themes.

The CVSS score of 7.1 classifies this issue as high severity. The EPSS score of less than 1% suggests a very low likelihood of active exploitation at this time, and it is not listed in the CISA KEV catalog. The likely attack vector, inferred from the description, is reflected XSS that requires a victim to visit a crafted URL or submit a form that includes malicious input. The flaw does not provide remote or local code execution beyond the browser context.