The Asynchronous Javascript plugin for WordPress contains an improper neutralization of input during web page generation, identified as a Cross‑Site Scripting (XSS) flaw (CWE‑79). The plugin fails to escape or filter user‑controlled data before it is echoed back to the browser, allowing an attacker to inject and execute arbitrary JavaScript in the context of a victim’s session. This can lead to session hijacking, credential theft, or the execution of malicious payloads that compromise confidential information or alter web content.

The vulnerability affects the Asynchronous Javascript plugin version 1.3.5 and all earlier releases. The plugin is developed by Paris Holley and used within WordPress installations. Any WordPress site that has not yet upgraded from version 1.3.5 is potentially exposed.

The risk is moderate, as the vulnerability allows an attacker to run arbitrary script in the victim’s context. The low EPSS score and absence from the KEV catalog suggest that the exploitation probability remains low, but administrators should not underestimate the impact if exposed users are present.