The MP‑Ukagaka plugin for WordPress suffers from a reflected cross‑site scripting flaw in all releases up to 1.5.2. The vulnerability occurs because user supplied input is not properly sanitized before being echoed back to the browser. Based on the description, it is inferred that an attacker could inject arbitrary client‑side code, potentially enabling malicious actions such as session data theft, page defacement, or user redirection when the victim follows a crafted link.

Affected systems are all WordPress installations that have the MP‑Ukagaka plugin installed with a version of 1.5.2 or earlier. The vendor, ariagle, supplies the plugin. Any site using the legacy plugin is at risk and should be treated as affected.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is a reflected XSS that can be triggered by a crafted link, successful exploitation requires social engineering; the attacker must entice the victim to click a malicious link before the browser executes the injected script.