A reflected cross‑site scripting flaw allows attackers to insert malicious JavaScript into page output through URL or form input. The flaw arises because the plugin fails to neutralize user‑supplied data, causing browsers to execute the code in the context of the site or site owner. This can lead to defacement, theft of authentication cookies, or delivery of phishing content. The weakness falls under CWE‑79, which covers insufficient output encoding.

The vulnerability exists in the Motta Addons plugin for WordPress, produced by uixthemes. All releases prior to version 1.6.1 are affected, meaning any site that has installed the plugin before that update is at risk. The issue is present wherever the plugin renders user‑supplied parameters in web pages or admin screens.

The flaw carries a CVSS score of 7.1, signifying high severity with medium to high exploitability and significant impact on confidentiality and integrity via client‑side code injection. An attacker can exploit it by crafting a URL or query string with malicious payload that the plugin echoes back, which a visitor's browser will execute without filtering. Although an EPSS score is not available, the lack of an official advisory in the CISA KEV catalog suggests fewer known active exploits. Nevertheless, the high severity rating warrants immediate attention.