The Query Monitor plugin for WordPress is vulnerable to reflected cross‑site scripting due to insufficient sanitization and escaping of the $_SERVER['REQUEST_URI'] parameter in versions up to and including 3.20.3. A maliciously crafted URL can cause arbitrary web scripts to be executed in the browser of any user who opens the URL while the plugin is active.

All installations of Query Monitor version 3.20.3 or lower are affected. The plugin is typically used as a debugging tool on WordPress sites; any site running a vulnerable version and allowing the plugin to process request URIs in a public context is at risk.

The CVSS score of 7.2 indicates significant impact with moderate exploitability. No EPSS score is provided and the vulnerability is not listed in the CISA KEV catalog. Exploitation can occur remotely through a crafted link; the attacker only needs to persuade a legitimate user to visit the URL, after which the injected script runs without additional authentication.