Improper neutralization of user input during page generation in the aThemeArt Translations eDS Responsive Menu plugin allows a reflected cross-site scripting attack. This flaw originates from insufficient escaping when user-supplied data is echoed to the page, enabling an attacker to inject and execute arbitrary JavaScript code within the victim’s browser. Although the exploitation requires the victim to visit a crafted URL or submit a manipulated form, the impact would include theft of credentials, session hijacking, or the delivery of malicious payloads, compromising the confidentiality and integrity of the user session.

WordPress sites that have installed the eDS Responsive Menu plugin version 1.2 or earlier are affected. This applies to all installations of the aThemeArt Translations product that have not yet upgraded beyond version 1.2.

The CVSS score of 7.1 indicates a moderate to high risk. The EPSS score of less than 1% suggests a very low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector for this reflected XSS is inferred to be remote, requiring an attacker to supply a specially crafted input that the plugin fails to sanitize before rendering it to the user’s browser.