The vulnerability is an improper neutralization of input during web page generation that allows reflected cross‑site scripting. A malicious user can embed scripts into requests that are included in the browser’s response, facilitating the execution of arbitrary code in the victim’s browser and potentially leading to session hijacking or unauthorized data disclosure. The weakness is categorized as CWE‑79, a reflected XSS flaw.

All installations of the WordPress NaturaLife Extensions plugin that are version 2.1 or older are affected, including all earlier versions where the version could not be verified. The plugin is developed by stmcan.

The CVSS score of 7.1 indicates high severity, while the EPSS score is unavailable and the vulnerability is not listed in the CISA keV catalog, suggesting no confirmed exploit activity yet. The attack vector is most likely via a crafted URL or form input that is echoed back in the page. An attacker can exploit it remotely by luring a user to a malicious link or by manipulating parameters in a legitimate request.