The Blog Settings plugin for WordPress contains a reflected cross‑site scripting vulnerability that is triggered by the unsanitized 'page' parameter. The plugin fails to validate or encode this input before echoing it back to the browser, allowing an unauthenticated attacker to insert arbitrary JavaScript. If a victim follows a malicious link, the injected script will execute within their browser, giving the attacker the ability to run client‑side code on the victim’s session.

All WordPress installations using the Blog Settings plugin developed by phpsandeepkumar, for any version up to and including 1.0, are affected. The vulnerability exists in every released version of the plugin whose version number is 1.0 or lower.

The CVSS score of 6.1 places this issue in the medium severity range, and the EPSS score is not available. It is not listed in the CISA KEV catalog. An attacker can exploit the flaw by crafting a URL that contains a malicious payload in the 'page' query parameter and convincing a victim to click the link. No privileged access or additional preconditions are required, so the attack vector is accessible to any external actor.