An improper neutralization of user input during page rendering in the Iqonic Design KiviCare plugin allows reflected cross‑site scripting. A malicious actor can create a specially crafted URL or form payload that injects JavaScript into the browser of any user who views the affected page. The injected script runs with the privileges of the visiting user, potentially leaking session cookies, defacing content, or hijacking the session.

WordPress sites that have installed the Iqonic Design KiviCare plugin version 3.6.16 or earlier are impacted. The flaw applies to all releases from the earliest version through 3.6.16.

The base CVSS score of 7.1 reflects high severity, driven by the lack of authentication requirement and the need for only a crafted input. While the EPSS score is not available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, an attacker can exploit the flaw by presenting a malicious link to any visitor. The attack vector is remote and requires no purchase of the plugin or special permissions, yielding moderate to high exploitability.