The Scroll rss excerpt plugin contains an improper neutralization of input during web page generation that permits reflected cross-site scripting (XSS). An attacker can inject malicious script into a request that is then executed in the victim’s browser when the plugin renders the content. The impact is the potential theft of session cookies, credential hijacking, defacement of the site, or execution of arbitrary actions on behalf of the user.

All installations of the Scroll rss excerpt WordPress plugin created by gopiplus@hotmail.com and running any version up to and including 5.0 are affected. The vulnerability is not restricted to a narrow sub‑release; any release bearing the same codebase through 5.0 is vulnerable.

The CVSS score is 7.1, indicating a moderate severity. The EPSS score is under 1%, suggesting a low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Because it is a reflected XSS, the attacker must convince a victim to visit a crafted URL or submit malicious input that is reflected back; this requires a user interaction, but if successful it can compromise the browser session of that user.