The vulnerability is an unauthenticated Cross Site Scripting (XSS) flaw in the picu WordPress plugin up to version 3.10.1. The flaw allows an attacker to inject malicious script that is executed in the browsers of visitors to the site. This is an input validation weakness (CWE‑79) where untrusted data is displayed without proper encoding or sanitisation.

The vulnerability impacts the picu WordPress plugin, specifically versions up to and including 3.10.1, used on WordPress sites. Users running these versions are susceptible if the plugin processes data from unauthenticated users.

The CVSS score of 7.1 assigns a high severity to the flaw. The EPSS score of 0.00237 (approximately 0.24%) indicates a very low exploitation probability. It is not listed in the CISA KEV catalog, indicating it has not yet been observed as part of an active exploitation campaign. The likely attack vector is an unauthenticated web user submitting malicious input through any form or endpoint handled by the picu plugin. Based on the description, exploitation requires no special privileges beyond normal web access.