This vulnerability allows an attacker to execute arbitrary scripts in a victim’s browser when they view a comment generated by the Fancy Comments WordPress plugin. The plugin fails to properly escape user supplied input, leading to a reflected Cross‑Site Scripting issue (CWE‑79). An attacker could inject malicious JavaScript to steal session cookies, deface the site, or redirect users to phishing pages.

Heateor Support Fancy Comments WordPress plugin, all releases up to and including version 1.2.21 are affected. Versions newer than 1.2.21 have not been reported to contain this issue.

The CVSS score of 7.1 indicates a moderate‑to‑high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting there is no widespread active exploitation. The likely attack vector is the publicly accessible comments interface, where a crafted URL or form input is reflected without sanitization. Because the flaw is a reflected XSS, an attacker needs only to lure a victim to a malicious link, making it easy to use socially engineered phishing or malicious links. Overall the risk is significant for websites that have the vulnerable plugin enabled.