A reflected cross‑site scripting (XSS) flaw in the Ultra WordPress Admin plug‑in lets an attacker inject arbitrary JavaScript into pages viewed by site administrators and other users. Because the input is not properly sanitized, malicious code can run in the victim’s browser, enabling session hijacking, cookie theft, defacement, or phishing attacks. The weakness is categorized as improper neutralization of input during web page generation (CWE‑79).

The vulnerability affects themepassion’s Ultra WordPress Admin plug‑in, versions from the earliest to 11.7 inclusive. Any installation running a version numbered 11.7 or lower is impacted.

This issue carries a CVSS score of 7.1, indicating a moderate to high severity level. The EPSS score is not reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting that widespread exploitation has not yet been observed. The attack vector is inferred to be remote: an adversary can craft a URL or embed malicious parameters in a form so that when a target user visits the page, the injected script executes in their browser. The flaw does not require privileged access; any authenticated or even unauthenticated user with a valid session can be targeted.