A reflected XSS vulnerability exists in the Taboola Pixel WordPress plugin up to version 1.1.4. The plugin fails to neutralize certain user‑controlled input before reflecting it in a generated HTML page, allowing an attacker to inject and execute arbitrary JavaScript in the victim’s browser. This can enable session hijacking, defacement, or the execution of malicious redirects, compromising user isolation and data integrity.

WordPress sites that use the Taboola Pixel plugin with a version less than or equal to 1.1.4 are affected. No further operating system or WordPress version details are specified in the advisory.

The CVSS score of 7.1 indicates a medium severity vulnerability. EPSS information is unavailable and the issue is not listed in the CISA KEV catalog. Because the flaw is a reflected XSS, an attacker can trigger exploitation by delivering a specially crafted URL or input to unwary users; no administrative or elevated privileges are required. While the risk per individual visitor is moderate, high traffic sites or those lacking additional content filtering may experience broader impact.