The Comment Genius plugin for WordPress, versions up to and including 1.2.5, fails to sanitize or escape the $_SERVER['PHP_SELF'] variable when rendering content. This deficiency lets attackers inject arbitrary JavaScript that is executed in the browsers of visitors who click a specially crafted link. The impact is the potential execution of malicious scripts on the victim’s browser, which can lead to data theft, session hijacking, or defacement of the site. The weakness aligns with CWE-79 (Improper Neutralization of Input During Web Page Generation).

Any WordPress installation running the Comment Genius plugin version 1.2.5 or older is vulnerable. This includes all sites that have not upgraded beyond the 1.2.5 release during the first year of 2026.

The CVSS score of 6.1 indicates moderate severity, reflecting the requirement of a crafted user interaction to exploit the flaw. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The likely attack vector involves an unauthenticated adversary persuading a legitimate user to click a malicious link that contains the injected payload, resulting in reflected client‑side script execution.