The WordPress Simple URLs plugin, versions 151 and earlier, contains a client‑side cross‑site scripting flaw (CWE‑79). Based on the description, attackers can inject arbitrary JavaScript into the plugin’s output, which will execute in visitors’ browsers when viewing affected pages. The CVE does not explicitly state further impact, so typical XSS concerns such as defacement, credential theft, or data exfiltration may result if the injected script targets users or site data.

WordPress sites that employ the Simple URLs plugin version 151 or earlier, authored by Andrew Fiebert, are the only systems identified as affected in the CVE report.

The EPSS score of less than 1 % indicates a very low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The CVSS base score of 5.9 points to medium risk for affected sites. The description does not detail how the vulnerability is triggered, so the likely attack vector is inferred to involve submitting malicious payloads through the plugin’s editable fields or WordPress admin interface, causing unsanitized user input to be rendered as executable code. This inference is based on typical XSS mechanisms observed in WordPress plugins.