An attacker can craft a URL that inserts arbitrary JavaScript into the page when the victim clicks the link. The vulnerability exists in all versions up to 1.0.0 of the StyleBidet WordPress plugin and is caused by insufficient input sanitization and output escaping. An unauthenticated user can exploit it by sending a malicious link to any visitor of the site, leading to potential theft of session cookies, defacement, or drive‑by compromise. The weakness is a classic reflected XSS (CWE‑79).

The affected product is the WordPress plugin StyleBidet (indextwo:StyleBidet). All released versions up to and including 1.0.0 are impacted. No specific version numbers beyond the general upper bound are listed, so any deployment of a pre‑1.0.0 build must be considered vulnerable.

The CVSS base score of 6.1 indicates medium severity; the EPSS score below 1 % suggests that exploit probability is currently very low, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack requires the victim to click a crafted link, a common social‑engineering vector. Once a victim executes the injected script in their browser, the attacker can execute arbitrary actions inside the context of the site’s domain. While the likelihood of widespread exploitation is low, the impact to a compromised user can be significant, especially on sites where users have administrative privileges.