Improper neutralization of input caused a reflected XSS flaw in RealMag777 TableOn posts‑filterable plugin versions up to and including 1.0.4.2. The vulnerability allows an attacker to inject arbitrary HTML or JavaScript that is echoed back in the victim’s browser, potentially enabling session hijacking, credential theft, or defacement of the site. The flaw meets CWE‑79 and its impact is confined to the individual user who views the crafted request; it does not provide persistence or server‑side code execution.

WordPress sites that have the RealMag777 TableOn posts‑filterable plugin installed with version 1.0.4.2 or earlier. No other WordPress plugins or core versions are affected.

The CVSS score of 7.1 indicates a high severity, driven by user interaction and state‑less exploitation. The EPSS score of <1% suggests that active exploitation is unlikely at present, and the flaw is not listed in the CISA KEV database. An attacker would need to supply a crafted query string or form input that the plugin reflects unescaped. The necessary conditions are external and remote, but user action (clicking a link or submitting a form) is required to trigger the XSS.