The vulnerability is a reflected XSS that allows attackers to inject scripts through the 'url' and 'regex' parameters on the admin_regex_test.php page in the rexCrawler plugin. This flaw affects WordPress multisite installations and those with unfiltered_html disabled, enabling execution of arbitrary scripts in admin pages after an administrator clicks a crafted link.

The affected product is the rexCrawler WordPress plugin by larsdrasmussen, with all versions up to and including 1.0.15 impacted. Administrators should check whether their site runs any of these unstable releases and ensure they are on a supported version.

The CVSS base score is 6.1, indicating medium severity. No EPSS data is provided and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to prompt a legitimate administrator to access the vulnerable endpoint, typically through social engineering or phishing with a malicious link, after which the unsanitized parameters allow injection of malicious JavaScript.