The Export Media URLs plugin contains an Improper Neutralization of Input During Web Page Generation flaw that allows attackers to inject malicious scripts into the page content. When a crafted request is processed, the plugin reflects untrusted input back in the browser without proper escaping. This could enable an attacker to execute arbitrary client‑side code, potentially capturing credentials, hijacking user sessions, or performing phishing attacks. The weakness is identified as CWE‑79.

All released versions of the Atlas Gondal Export Media URLs plugin up to and including version 2.2 are affected. If your site is running any of those releases, the vulnerability may be present.

The CVSS score of 7.1 indicates a high severity for this XSS flaw, yet the EPSS score is below 1% so the risk of widespread exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Attackers can potentially exploit the flaw by luring a victim to a specially crafted URL or by embedding malicious input into a page that uses the plugin. Because the XSS is reflected, the victim must be able to visit the affected page for the attack to succeed. The exploitation does not require elevated privileges on the target system; it only depends on user interaction with the crafted request.