A reflected Cross‑Site Scripting flaw allows an attacker to inject malicious script into pages displayed by the WP Associate Post R2 plugin, compromising user data and session integrity. The plugin fails to neutralize user‑supplied input when rendering its pages. An attacker can execute arbitrary JavaScript in the victim’s browser, potentially stealing credentials, cookies, or injecting further malicious traffic.

The vulnerability impacts WordPress sites running Delight Star Inc. WP Associate Post R2 versions up to and including 5.0.1. Versions prior to the plugin’s first release are also included in the affected scope.

The CVSS base score of 7.1 indicates a high impact but not critical severity. No EPSS score is available, and the flaw is not listed in CISA KEV, suggesting a moderate likelihood of exploitation. Typical exploitation would involve an attacker creating a malicious URL containing the injected script. Any user who follows that link would be susceptible, so exposure is possible to all site visitors unless mitigated.