The flaw is an unauthenticated Cross‑Site Scripting (XSS) vulnerability that allows an attacker to inject malicious script code into the HTTP Requests Manager plugin for WordPress. Because the application does not properly validate or encode user input, the injected code can execute within the web browser of any visitor who views the affected page or content. This vulnerability can lead to theft of session cookies, defacement, or other client‑side attacks against site users.

The vulnerability affects all installations of the HTTP Requests Manager plugin by veppa that are at version 1.3.11 or earlier. Users running WordPress with this plugin should verify their version and determine whether an upgrade is available.

With a CVSS score of 7.1, the vulnerability is classified as high severity, and its EPSS score is 0.237%. The attack is likely to be performed by sending crafted requests to the vulnerable plugin endpoint, which does not require authentication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the potential impact on site users warrants immediate remediation.