The flaw is improper neutralization of input during web page generation in the Effect Maker plugin, allowing an attacker to inject and execute malicious JavaScript within the victim’s browser. The vulnerability is classified as CWE-79 and has a CVSS score of 6.5, indicating medium severity. Because the code that renders user input is not properly sanitized, arbitrary client-side scripts can be injected.

The vulnerability affects all releases of the Effect Maker plugin developed by anibalwainstein through version 1.2.1. Any WordPress site that installed or upgraded to these versions inherits the flaw regardless of configuration.

The EPSS score is less than 1 % and the vulnerability is not listed in CISA KEV, suggesting limited exploitation in the wild. Until the plugin is updated or removed the system remains exposed. Exploitation would involve delivering malicious payload via the plugin’s input handling during page rendering, causing the payload to run in the browser context of any user who loads the page.