The affected software contains a reflected Cross‑Site Scripting vulnerability (CWE‑79) that allows an attacker to embed malicious scripts into the web page output of the Taskbuilder plugin. When a crafted request containing attacker‑supplied input is processed, the input is reflected directly in the browser without proper sanitization, permitting the execution of arbitrary JavaScript in the victim’s context.

The vulnerability affects the WordPress Taskbuilder plugin for all versions through and including 4.0.9. Users running any of those releases are potentially exposed if the plugin is enabled.

The CVSS score of 7.1 and a very low EPSS (<1%) suggest that while the flaw is technically high, real‑world exploitation is unlikely. It is not listed in CISA’s KEV catalog. Because the flaw is reflected XSS, an attacker only needs to persuade a victim to visit a specially crafted URL or link; no authentication or elevated privileges are required, making the attack prone to phishing or link‑sharing vectors.