The vulnerability stems from improper neutralization of user input during web page generation, allowing a reflected cross-site scripting (XSS) flaw. An attacker can inject malicious script snippets that execute in the victim’s browser when a crafted URL is visited. This can lead to session hijacking, cookie theft, defacement or other client-side attacks, as the flaw resides in the WordPress UpSolution Core plugin.

The UpSolution Core plugin for WordPress is impacted from its initial release through version 8.41. Any instance using a version up to and including 8.41 remains vulnerable and requires remediation.

The CVSS score of 7.1 indicates a moderate-to-high risk level. Attackers can exploit the flaw simply by sending a crafted URL or payload to a site hosting the vulnerable plugin, without needing elevated privileges. Because the flaw is reflected in the browser and no authentication is needed, it can be used by anyone who can generate a link and lure a user to click. The EPSS information is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog, but its high score and wide plugin usage make it a significant threat for active WordPress sites.