The DukaPress WordPress plugin fails to sanitize and escape a parameter before displaying it on the page, allowing an attacker to inject arbitrary JavaScript through crafted requests. The reflected cross‑site scripting can run in the victim’s browser, potentially creating session hijacking, cookie theft, or execution of privileged actions on behalf of high‑privilege users such as administrators.

All installations of the DukaPress WordPress plugin with versions up to and including 3.2.4 are affected. The vendor is listed as Unknown and no patch version is identified in the supplied data.

The CVSS score of 7.1 labels this vulnerability as High severity, while its EPSS score of less than 1% and absence from the KEV catalog suggest a low likelihood of immediate exploitation in the wild. Nevertheless, attackers can exploit this flaw remotely by crafting a malicious payload that is reflected in the plugin’s output, thereby affecting users with administrative privileges. The high impact to privileged accounts warrants prompt remediation.