This flaw is an improper neutralization of input during web page generation that enables reflected cross-site scripting in the WordPress JetProductTables plugin. Unsanitized user input is echoed back to the page, allowing an attacker to embed malicious JavaScript that executes in the context of any user who views the crafted page. The injected script could steal session cookies, deface the site, or redirect users to phishing services. The weakness is a CWE-79 flaw, providing attackers a means to compromise user sessions and manipulate page content.

Any WordPress site running Crocoblock JetProductTables version 1.2.4 or earlier is affected. The vulnerability resides solely in the plugin code, making it independent of the underlying operating system or server platform.

The CVSS score is 7.1, indicating a high-severity condition. EPSS score of < 1% indicates a very low exploitation probability, but the flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply crafted input through the plugin's web interface or a malicious URL; a victim who visits or interacts with the input will have the injected script executed. This remote attack path relies on a web request, so any untrusted input reaching the plugin can trigger the flaw.