This vulnerability permits reflected cross‑site scripting in the Arevico WP Simple Redirect plugin. When a user follows a specially crafted URL, the plugin fails to properly neutralize input before rendering it in the web page, enabling an attacker to inject and execute arbitrary client‑side script. The impact is limited to the victim’s browser, potentially leading to session hijacking, defacement, or phishing through the compromised website.

The affected product is the WordPress WP Simple Redirect plugin by Arevico, versions n/a through 1.1. All installations of these versions on WordPress sites are vulnerable.

With a CVSS score of 7.1 the vulnerability is considered medium‑high in severity. The EPSS score of < 1% indicates a very low likelihood of exploitation in the wild. The issue is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, via a crafted URL that an attacker can share or embed, leading the victim’s browser to execute malicious code.