The deficiency in Hide My WP is improper handling of user‑supplied input when generating a page. An attacker can embed malicious JavaScript in a crafted URL so that, when a victim clicks the link, the script runs in the victim’s browser under the site’s origin. While the description does not explicitly state the payload consequences, it is likely that the attacker can use the script to steal cookies, hijack sessions, deface content, or redirect users to phishing sites.

WordPress sites that have the Hide My WP plugin installed, versions up to 6.2.12. The plugin is maintained by wpWave and is used to control visibility of content; the vulnerability does not affect the WordPress core itself.

The CVSS score of 7.1 indicates a moderate to high severity, while an EPSS of <1% denotes a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. It is most likely exploitable via a reflected XSS attack in which an attacker convinces a user to visit a specially crafted link. When exploited, the impact is confined to the victim’s browser, but the attacker can compromise the user’s session and access any content the user could reach.