The Ohio Extra plugin for WordPress contains a cross‑site scripting vulnerability that is triggered by data entered into its subscriber fields. When the plugin outputs this data, any injected script is executed in the browsers of site visitors or other subscribers, allowing the attacker to run arbitrary code within the context of the site.

Affected versions include all releases of Colabrio Ohio Extra up to and including 3.6.8. The flaw exists when the plugin accepts user‑supplied data from subscriber fields without proper sanitization. Users on older versions should verify that their installed plugin number falls within the affected range.

The CVSS base score of 6.5 indicates medium severity. The EPSS score of less than 1% indicates a low likelihood of exploitation, but the presence of an XSS flaw in a publicly accessible plugin could still be abused by automated scanners. The issue is not listed in CISA’s KEV catalog. The likely attack vector is through subscriber input fields in the plugin, inferred from the description.