The Writeprint Stylometry plugin for WordPress contains a reflected Cross‑Site Scripting vulnerability that allows an attacker to inject arbitrary JavaScript into the page output by supplying a specially crafted value for the 'p' GET parameter. The vulnerable code is located in the bjl_wprintstylo_comments_nav() function, which echoes $_GET['p'] directly into an HTML href attribute without proper escaping, thereby enabling script execution in the context of any authenticated user who follows the link. This weakness corresponds to CWE‑79: Improper Neutralization of Input During Web Page Generation.

All releases of the Writeprint Stylometry plugin up to and including version 0.1 are affected. The vendor is alhadeff. No specific sub‑versions are listed; any installation running 0.1 or earlier carries the same risk.

The issue has a CVSS v3.1 score of 6.1, indicating medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. Exploitation requires a web‑based attack vector: an attacker with Contributor‑level or higher permissions can supply a malicious value for the 'p' parameter, causing script execution in the context of any authenticated user who follows the link. The attack is therefore internal or social‑engineering driven rather than a publicly exploitable remote code execution.