The rognone WordPress plugin is vulnerable to a reflected cross‑site scripting flaw in versions up to and including 0.6.2. A lack of proper input sanitization and output escaping on the 'a' parameter lets an unauthenticated attacker inject arbitrary JavaScript that runs in the victim's browser when they visit a crafted link. This can result in cookie theft, session hijacking, defacement, or launch of further client‑side attacks. The weakness is identified as CWE‑79.

WordPress sites that have the rognone plugin installed, specifically version 0.6.2 or earlier, are affected. Sites running any older revision of the plugin fall under the same risk.

The CVSS score of 6.1 rates this vulnerability as moderate; its EPSS score is not currently available, and it is not listed in the CISA KEV catalog. Exploitation requires no privileged access; an attacker can simply send a malicious URL to a victim who interacts with the link. Because the flaw is client‑side, the attack is limited to the victim's browser, but the impact on the user can be significant and widespread if the site is trafficked. Administrators should treat this as a moderate‑to‑high risk due to the ease of exploitation and potential for post‑compromise actions.