The vulnerability is an unauthenticated Cross Site Scripting flaw that exists in all versions of the WordPress BEAR plugin up to and including 1.1.8. The flaw stems from insufficient input sanitization, allowing an attacker to inject arbitrary JavaScript code that executes in the browser context of any user who views the injected content. This can lead to session hijacking, cookie theft, or other client-side compromise. The weakness is classified as CWE‑79.

The affected system is the WordPress BEAR plugin developed by RealMag777. All installations of the plugin with a version number less than or equal to 1.1.8 are vulnerable. The vendor’s official fix is to upgrade to version 1.1.9 or later.

The CVSS score of 7.1 indicates a high severity, and the lack of an EPSS score suggests a low but non‑zero likelihood of exploitation at the time of this analysis. The plugin is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is unauthenticated web-based input that is rendered by the plugin without proper escaping. An attacker can exploit the flaw by crafting a malicious input in any field that the plugin accepts and then causing a legitimate user to view that input, thereby executing the injected script.