The vulnerability is an improper neutralization of user input in the PenciDesign Penci Soledad Data Migrator WordPress plugin, leading to reflected Cross‑Site Scripting. When a request contains certain parameters, the plugin outputs the data directly to the web page without encoding, allowing an attacker to inject and execute arbitrary JavaScript in the context of any user who visits the crafted URL.

This flaw impacts the WordPress plugin Penci Soledad Data Migrator developed by PenciDesign. All releases from the earliest available version up to and including 1.3.1 are affected. Site owners running any of these versions should verify the installed version and consider remediation.

The CVSS base score of 7.1 signifies moderate to high severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a reflected XSS payload embedded in a crafted link that the user must visit; this inference is drawn from the described behavior that the plugin echoes untrusted input to the page.