An input value that is reflected in a web page is not correctly escaped, enabling malicious scripts to run in a victim’s browser. Such reflected XSS can lead to the execution of arbitrary JavaScript, facilitating cookie theft, session hijacking, or redirection to phishing sites. The weakness is a classic input validation flaw (CWE‑79) and is rated medium‑high severity (CVSS 7.1).

The vulnerability affects the WordPress plugin LambertGroup – AllInOne – Banner with Thumbnails version 3.8 and earlier, which is distributed by LambertGroup. No further version qualifiers are specified beyond the <=3.8 range.

The low EPSS (<1%) indicates a small but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker would most likely craft a malicious URL or form input that triggers the unescaped output, requiring that a user visits or interacts with the affected page. If successful, the attacker can run scripts in the user’s browser context, potentially compromising credentials or performing phishing actions.