The vulnerability is an improper neutralization of user‑controlled input during page generation, classified as Cross‑Site Scripting (CWE‑79). It allows an attacker to embed malicious scripts that are reflected in the browser of any visitor who follows a crafted link or submits a form using the plugin. The injected script can hijack user sessions, phish for credentials, or modify page content, thereby undermining confidentiality, integrity, and availability of the website’s users.

The problem exists in the WordPress Hotel Listing plugin developed by e‑plugins. Any WordPress installation running the plugin from its earliest release up to and including version 1.4.0 is affected. The plugin is used to display hotel listings, so pages that render data from this plugin are potentially vulnerable to reflected script payloads.

The base CVSS score is 7.1, marking the flaw as high severity. The EPSS score of less than 1 % indicates that active exploitation is currently rare, and it is not included in the CISA KEV catalog. Attackers can exploit the flaw remotely by embedding a malicious payload in a link or query string that the plugin reflects in an echoed output; once a user follows such a link the script runs with the victim’s privileges. The consequence is significant because arbitrary JavaScript can steal cookies, mimic legitimate site interactions, or redirect to malicious domains.