The Quote Master plugin for WordPress fails to neutralize user‑supplied data before rendering a page, allowing an attacker to embed malicious script code that will execute in the victim’s browser. This reflected cross‑site scripting flaw can lead to cookie theft, session hijacking, page defacement, or injection of additional malicious payloads, and is identified as a CWE‑79 weakness. The vulnerability exists in the plugin’s rendering path and requires no authentication; any user who loads a vulnerable page can be impacted.

The flaw affects the Frank Corso Quote Master WordPress plugin. All released versions from the initial deployment up through version 7.1.1 are vulnerable. Site owners using any of those versions should consider the plugin out of date and at risk until updated.

The CVSS score of 7.1 denotes a high severity reflected XSS. The EPSS score of <1 % indicates a low probability of exploitation in the near future, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an attacker creating a malicious URL that embeds forged script code and then encouraging or tricking a user to visit it. Because the flaw is reflected, the malicious code is echoed back in the HTTP response and executed by the victim’s browser, making it a straightforward, client‑side attack that does not require authentication.