A reflected cross‑site scripting flaw in the Netgsm WordPress plugin allows an attacker to inject and execute arbitrary JavaScript when an affected user requests a page that reflects the malicious input. The injected script can steal cookies, perform actions on behalf of the user, deface content, or redirect to phishing sites. The weakness is a typical input‑validation problem (CWE‑79).

WordPress installations that include the Netgsm plugin version 2.9.63 or earlier are vulnerable. All sites running these plugin versions should be considered compromised until the issue is fixed or mitigated.

The CVSS score of 7.1 indicates a high risk to confidentiality and integrity. The EPSS score of less than 1 % suggests that real‑world exploitation is currently uncommon, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply malicious input via a normal HTTP request, making it a reflected XSS that can be triggered by a malicious link or form input visible to the user.