A reflected cross‑site scripting vulnerability exists in totalbounty’s Widget Logic Visual plugin due to insufficient neutralization of user input during web page generation. This flaw can be leveraged to inject malicious scripts that execute in the context of a victim’s browser, potentially enabling session theft, defacement, or malicious redirects. The weakness is identified as CWE‑79.

The Vulnerable product is the WordPress plugin Widget Logic Visual from the vendor totalbounty. All versions from the earliest available until and including 1.52 are affected, so any site running the plugin at or below that version is at risk.

The CVSS score of 7.1 indicates a high impact for an attacker who succeeds. The EPSS score of less than 1% suggests that exploitation is currently rare, and the vulnerability is not yet listed in CISA’s KEV catalog. The most likely attack vector is a crafted HTTP request that includes malicious payloads which the plugin echoes back to the visitor. Once the payload is executed, an attacker can perform a range of client‑side attacks, but no direct server‑side compromise is indicated in the current description.