The Simple Archive Generator plugin contains an improper neutralization of input during web page generation that allows an attacker to inject malicious JavaScript into responses. If executed, the injected script runs in the browser of any user who views the affected page, potentially enabling cookie theft, session hijacking, or malicious redirects. The weakness is classified as CWE‑79 and carries a CVSS score of 7.1, which indicates a high severity for impact on confidentiality and integrity of user sessions.

This vulnerability affects the WordPress plugin Simple Archive Generator from peterwsterling, with all versions up to and including 5.2. Users who have not upgraded beyond version 5.2 remain vulnerable.

The EPSS score of less than 1% suggests that exploitation attempts are currently rare, and the flaw is not listed in the CISA KEV catalogue. The likely attack vector involves an attacker crafting a URL or form input that is reflected unescaped in the page output; any visitor who follows that link would be exposed. While the exploitation path is straightforward, the need for a user to request the vulnerable page and the low EPSS score combine to give a moderate overall risk, but the potential impact warrants urgent remediation.