The vulnerability arises from improper neutralization of script‑related HTML tags, allowing attackers to inject or reflect CSS and other script content into the web page that the user sees. This basic XSS flaw can lead to session hijacking, defacement, or malicious redirects if an attacker tricks a victim into visiting a crafted URL or form. The weakness is a classic CWE‑80 input validation flaw.

WordPress sites that have the Easy Media Download plugin by Noor Alam installed at version 1.1.11 or earlier are affected. The vulnerability applies to all installations of this plugin from its earliest release up to and including 1.1.11.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at this time. The flaw is not listed in the CISA KEV catalog, further indicating limited known exploitation. Exploitation requires an attacker to supply a crafted request that is reflected by the plugin; a vulnerable end‑user must then open the crafted URL, making the attack vector primarily a reflected XSS scenario.