The vulnerability is a reflected cross‑site scripting flaw that occurs when user‑supplied input is incorporated into web page output without proper neutralization. An attacker can embed malicious JavaScript in crafted requests that is executed in the victim’s browser when the page is rendered. This can enable session hijacking, credential theft, defacement or the execution of additional malicious payloads. The weakness is classified as CWE-79 and the affected versions are up to and including 1.2.1.1 of the WordPress My Post Order plugin.

Kapil Chugh’s My Post Order WordPress plugin, versions from the earliest available up through 1.2.1.1. Site owners using any of these versions are at risk.

The CVSS score of 7.1 indicates a medium‑to‑high impact. The EPSS score is below 1%, suggesting that active exploitation is presently uncommon, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a reflected endpoint that accepts user input via query parameters or POST data; the attacker needs to entice a user to visit a crafted URL or submit malicious form data in an authenticated session. No additional system‑level prerequisites are required beyond a vulnerable plugin installation.