The CM Custom Reports plugin for WordPress is affected by a reflected Cross‑Site Scripting flaw that occurs when the 'date_from' or 'date_to' parameters are not properly sanitized or escaped. An unauthenticated attacker can provide malicious input through these parameters, causing the plugin to output a script that will execute in a victim’s browser when the page is loaded. The vulnerability allows the injection of arbitrary web scripts, which would run with the privileges of the user viewing the page.

WordPress sites that have the CM Custom Reports plugin from Creativemindssolutions installed on versions 1.2.7 or earlier are affected. The flaw is present in all releases up to and including 1.2.7, as evidenced by the source code references for the 1.2.7 tag and trunk.

The CVSS score of 6.1 indicates a moderate severity reflected XSS vulnerability. The EPSS score of less than 1% suggests a low likelihood of exploitation in the near term. The flaw is not listed in the CISA KEV catalog. Because the flaw can be triggered by an unauthenticated attacker through crafted URLs or form inputs, the primary attack vector is social engineering via a malicious link. Successful exploitation requires a victim to load the affected page, after which the injected script will execute in the victim’s browser.