The vulnerability is a reflected cross‑site scripting flaw that allows user input to be improperly neutralized in the WordPress Whizz Plugins plugin. By manipulating query parameters or form fields, an attacker can inject malicious JavaScript that is reflected back into the page when a victim visits the crafted URL or submits the input. This can result in the execution of arbitrary script in the victim’s browser and unintended page content.

The flaw affects the Fox‑Themes Whizz Plugins package for WordPress, version 1.9 and all earlier releases. Any WordPress installation that has the plugin installed with a version ≤ 1.9 is potentially vulnerable. No other products or versions are listed as affected.

The CVSS v3 score of 7.1 signifies a high severity for this reflected XSS vulnerability. The EPSS score of less than 1% indicates that exploitation attempts are currently rare, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves the attacker crafting a malicious URL or input that is processed by the plugin and reflected back into the browser of a user who visits the site. If the victim clicks the link or submits the input, the injected script runs in the browser context with the privileges of the visitor, potentially affecting the displayed content.