The vulnerability is a Reflected Cross‑Site Scripting flaw where unsanitized user input is inserted into a web page generated by the PixFort pixfort Core plugin. An attacker who can control the input can cause arbitrary JavaScript to run in the browsers of any visitor who views the affected page. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The flaw does not provide direct code execution but enables compromising the confidentiality, integrity, or availability of the web application through client‑side attacks.

The issue affects the PixFort pixfort Core WordPress plugin version 3.2.22 and all earlier releases. No other product versions or vendors are listed as affected.

With a score of 7.1, the vulnerability represents a moderate to high risk. The exploitation probability remains below 1 %, indicating a low likelihood of exploitation at the present time, and the vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is a crafted request that is reflected by the plugin into an HTTP response, and the exploitation requires only that a user correctly load the maliciously constructed URL. Despite the low exploitation probability, the impact of a successful attack warrants proactive monitoring of user activity and prompt remediation when a patch becomes available.