The List Site Contributors plugin for WordPress has a reflected cross‑site scripting vulnerability that arises when the alpha parameter is used without proper sanitization or escaping. An unauthenticated attacker can create a URL with malicious payload in that parameter, which is reflected in the page output and executed in the victim’s browser when the link is visited.

This flaw affects the mallsop List Site Contributors plugin for WordPress in all releases up to and including version 1.1.8. Any site that has installed a vulnerable version remains at risk until the plugin is upgraded.

The CVSS base score is 6.1, placing the issue in the moderate range. The EPSS score of 1 % suggests a relatively low probability of exploitation in the wild. The plugin is not listed in CISA’s KEV catalog. Exploitation would require the attacker to entice a user to click a crafted link that contains the vulnerable alpha parameter, after which the reflected script runs in the context of the user’s session.