The iSape plugin for WordPress suffers from an improper neutralization of input during page generation, a classic reflected cross‑site scripting flaw (CWE‑79). The flaw allows an attacker to inject and execute arbitrary scripts when a victim visits a crafted URL or interacts with the plugin’s input fields. The potential impact is the execution of arbitrary JavaScript in the victim’s browser; specific consequences such as session hijack or cookie theft are inferred but not explicitly stated in the CVE description.

Affected are all releases of the iSape plugin from itex, specifically versions from the earliest available through version 0.72 inclusive. The plugin is a WordPress extension that can be installed on any WordPress site, and any site that has a vulnerable iSape version installed is implicitly affected.

The CVSS base score is 7.1, indicating high severity. The EPSS score is below 1%, indicating a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to direct a victim to load a crafted URL or submit input to the plugin in order to execute malicious code. Thus the attack vector is client‑side and does not require server‑side code execution.