The Templately plugin for WordPress contains an input validation flaw that permits any visitor to inject arbitrary JavaScript into pages served by the site. Because the flaw is unauthenticated, an attacker can deliver a crafted URL or upload content that triggers the cross‑site scripting, potentially hijacking user sessions, stealing credentials, or loading malicious payloads. The weakness is identified as CWE‑79 and carries a high severity with a CVSS score of 7.1.

The vulnerability exists in WPDeveloper’s Templately plugin for WordPress, affecting all releases through version 3.7.1. Sites that have not upgraded to 3.7.2 or later remain vulnerable.

The CVSS score of 7.1 indicates a high severity level. While the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the unauthenticated nature of the XSS flaw means that attackers can exploit it from any source. Likely attack paths involve a malicious link or input that the plugin fails to sanitize, causing script execution in the browsers of any site visitor. Administrators should regard this as a significant risk, especially on publicly exposed sites, and remediate promptly.