The vulnerability is a Reflected Cross Site Scripting (XSS) flaw caused by the Handmade Framework plugin’s failure to neutralize user‑supplied input during page rendering. An attacker can inject malicious scripts that are reflected back in the browser when the vulnerable page is accessed. This can lead to session hijacking, data theft, or execution of arbitrary actions on behalf of the user, impacting confidentiality, integrity and availability of the web application for any visitor who views the affected page.

The vulnerability exists in the WordPress "Handmade Framework" plugin provided by G5Theme and affects all releases through version 3.9. Any WordPress site that has this plugin installed and has not been updated beyond 3.9 is susceptible.

The CVSS base score of 7.1 indicates a high severity. Because this is a reflected XSS, exploitation requires only a crafted URL or link and does not need privileged access. The attack vector is likely via a browser endpoint that echoes user input, making the flaw easily exploitable by an attacker who convinces a victim user to visit a malicious link. The EPSS score is not available; the vulnerability is not listed in CISA’s KEV catalog, but the high CVSS and open‑web exploitation potential suggest a significant risk.