The vulnerability is an instance of improper neutralization of input during web page generation, classified as CWE‑79. It allows an attacker to inject malicious JavaScript that is reflected back to the user’s browser when a crafted URL or input is processed. The effect is that a victim who opens the malicious link will have the script executed in their browser context, enabling an attacker to hijack sessions, steal credentials, or deface the site.

The affected product is the WordPress plugin Homey Core from favethemes. All installations running version 2.4.3 or earlier are impacted; the issue originates with the plugin’s handling of user‑supplied input in the file rendering logic.

The CVSS score of 7.1 indicates a high‑to‑medium risk severity. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the reflected XSS by directing a victim to a specially crafted URL or by submitting malicious input that the plugin mistakenly renders without proper sanitization. The simplicity of the attack vector (any user who visits the URL) means that defenses should focus on patching and sanitization rather than relying on defensive perimeter controls alone.