The Legacy Admin plugin embeds user-supplied data directly into web pages without proper sanitization, creating a reflected cross‑site scripting flaw. When a victim visits a tampered URL or submits a malicious value, the browser may execute attacker‑supplied script. This can compromise the victim’s browser session, enabling cookie theft, session hijacking, or delivery of unwanted content.

All WordPress sites running ThemePassion Legacy Admin plugin version 9.5 or earlier. The vulnerability is present from the initial release up to and including 9.5.

The flaw carries a CVSS score of 7.1, indicating high impact, and is not listed in CISA’s KEV catalog. No EPSS score is available. The analysis of the reported behavior does not explicitly describe the attack vector; however, it is reasonable to infer that the vulnerability can be leveraged by crafting a malicious URL or form input that is reflected back to the user’s browser, as is typical for reflected XSS attacks. While the vulnerability does not grant server‑side code execution, it exposes affected users to client‑side compromise, potentially leading to credential theft or malicious redirect.