Technical impact
The vulnerability is an Improper Neutralization of Input During Web Page Generation defect, classified as a browser‑side cross‑site scripting flaw. The WPJAM Basic plugin can reflect malicious input into the DOM, allowing an attacker to inject arbitrary JavaScript that executes in a victim’s browser. This can lead to session hijacking, credential theft, page defacement, or redirection to malicious sites. The flaw is identified as CWE‑79 and carries a CVSS score of 7.1, indicating high severity.
Affected Systems
Denishua’s WPJAM Basic WordPress plugin is vulnerable in all releases up to and including version 7.1.2. Any installation running an affected release is exposed.
Risk and Exploitability
Exploitation requires only that a user visit a crafted URL or supply malicious input through the plugin, meaning the attack occurs entirely on the client side and does not need privileged access to the site. EPSS data is not available and the flaw is not listed in CISA’s KEV catalog, but the high CVSS rating and client‑side nature of the flaw suggest it is a priority to patch as it can enable powerful attacks against users.
