The vulnerability is an improper neutralization of user input when generating web pages in the Contact Manager plugin. Attackers can embed malicious scripts in URLs or form inputs that are reflected in the response, allowing them to execute JavaScript in the context of users who view the page. This can lead to page defacement, cookie theft, or other client‑side attacks.

This flaw is present in all releases of Kleor Contact Manager up to version 9.1. The plugin is available for WordPress sites and is used by any site that has installed the contact‑manager plugin before the reported release. The affected product is the Contact Manager plugin distributed by Kleor.

The CVSS score of 7.1 classifies the issue as high severity, and the absence of an EPSS score merely indicates that the exploitation probability is not publicly quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting that it is not a known exploited vulnerability, but reflected XSS is a well‑known attack vector that can be leveraged through crafted URLs over the network. Due to its client‑side nature, the attack requires user interaction, but once triggered, the attacker gains code execution within the victim’s browser.