An improper neutralization of user input in the Advanced Custom CSS plugin allows attackers to inject and execute arbitrary JavaScript on user browsers. This reflected cross‑site scripting can lead to credential theft, session hijacking, defacement of content, or distribution of malware. The vulnerability is a direct exploitation of client‑side weakness, causing the affected page to display attacker‑supplied code without proper encoding.

The flaw affects Wordpress installations that use the Advanced Custom CSS plugin version 1.1.0 or older, developed by prasadkirpekar. Users running any of these versions expose themselves to the risk, regardless of site size or traffic volume.

The CVSS score of 7.1 indicates medium to high severity. The EPSS score of less than 1% suggests a low probability of widespread exploitation, and the issue is not listed in CISA’s KEV catalog. Attackers can deliver malicious input via a crafted URL or form field that the plugin reflects in page output, making it straightforward to reach any visitor who loads the affected page.