This vulnerability is an improper neutralization of input that allows a reflected cross‑site scripting (XSS) attack. An attacker who succeeds can inject malicious scripts that run in a victim’s browser when they access the eHive Search plugin, potentially leading to session hijacking, credential theft, or defacement. The weakness is classified as CWE‑79, which focuses on unintended script execution via reflected user input.

Vendors etc. The affected product is eHive Search by Vernon Systems Limited. Versions up through and including 2.5.0 are vulnerable. Any deployment running 2.5.0 or earlier is at risk.

The CVSS v3.1 score of 7.1 indicates a high severity of this vulnerability. The EPSS score is less than 1 %, suggesting current exploitation activity is very low, and it is not listed in the CISA KEV catalog. The likely attack vector is via a crafted query string in a web request to the search functionality, where the plugin reflects user input back into the page without proper sanitization. An attacker would need the target site to load the vulnerable plugin and a user to visit the tampered URL to deliver malicious payloads.