The WordPress Timeline Event History plugin contains an improper neutralization of input during web page generation, allowing an attacker to inject arbitrary client‑side scripts into pages served by the plugin. This reflected cross‑site scripting flaw, identified as CWE‑79, enables the execution of arbitrary client‑side scripts when user input is reflected. The vulnerability is triggered by user‑controlled data that is not adequately sanitized before being reflected in the generated HTML.

All versions of the Timeline Event History plugin from the first release through 3.2 inclusive are affected, as provided by the vendor wpdiscover. Any WordPress installation that has one of these versions installed remains vulnerable unless it has been updated to 3.3 or later.

With a CVSS score of 7.1, the flaw is considered high severity. The EPSS score is less than 1%, indicating a low likelihood of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via a crafted web request that includes malicious payloads in query parameters or form fields; browsers rendering the reflected response will execute the embedded script.