An improper neutralization of input during web page generation in the Neoforum WordPress plugin allows attackers to inject malicious scripts that are reflected back to visitors via crafted URLs or form submissions. The flaw is a classic reflected XSS vulnerability (CWE‑79). Successful exploitation does not grant direct access to the server but can compromise the confidentiality and integrity of any user who views a manipulated page, leading to account hijacking, cookie theft, or defacement.

The vulnerability affects the Neoforum plugin developed by saeros1984 for WordPress, specifically all releases up to and including version 1.0. No newer versions were listed as affected.

The CVSS score of 7.1 indicates high severity. The EPSS score of less than 1% suggests a low exploitation probability at the time of analysis, and the issue is not listed in the CISA KEV catalog. The likely attack vector is user interaction via a web browser, inferred from the requirement that a victim must visit a specially crafted URL or submit a malicious form. Exploitation requires no privileged and can be performed from any network that can reach the target site.