Improper neutralization of user input during web page generation creates a reflected XSS flaw. The vulnerability allows an attacker to inject arbitrary script into a page viewed by an authenticated or unauthenticated user, potentially leading to session hijacking, defacement, or manipulation of form submissions. This weakness is classified as CWE‑79 and satisfies the core criteria for reflected XSS.

The flaw affects the RH Frontend Publishing Pro plugin developed by Sizam, specifically all versions before 4.3.4. The plugin has no versions listed as fixed in the vendor release notes, so any installation of 4.3.3 or earlier remains vulnerable. No other plugins or themes share this issue based on the current CNA data.

The CVSS base score of 7.1 indicates moderate to high severity. The EPSS score is reported as less than 1 %, indicating a low probability of exploitation at the time of analysis. The vulnerability is not identified in CISA’s KEV catalog. The attack vector is inferred to be a reflected XSS attack, most likely triggered by sending a malicious URL or input to a frontend form rendered by the plugin. Because the flaw relies on user control over input and lack of proper output encoding, any authenticated or unauthenticated visitor to a vulnerable page could be impacted.