The rognone WordPress plugin contains an input handling flaw that allows an unauthenticated attacker to inject arbitrary JavaScript by supplying a crafted value to the "mode" parameter. Because the plugin does not correctly sanitize or escape this input, any victim who follows a specially constructed link will have the malicious script executed in their browser. This can lead to script‑based data theft, session hijacking, or defacement of the affected site. The weakness corresponds to CWE‑79, which highlights improper input validation and insufficient output encoding.

The vulnerability affects the rognone plugin developed by federicocarrara, specifically versions up to and including 0.6.2 deployed on WordPress sites. Sites running an older rognone version are vulnerable by default.

The CVSS score of 6.1 indicates a medium impact. The EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw by simply including the malicious "mode" parameter in a URL and convincing a legitimate user to click it, without any authentication or advanced privilege. Because the plugin is widely used, the attack surface is substantial.