The vulnerability is an improper neutralization of input during web page generation, classified as a Cross‑Site Scripting flaw. The WP Grids EasyTest – Simplify A/B Testing plugin contains a DOM‑based XSS vulnerability that allows attackers to inject malicious scripts into content rendered by the plugin. User‑supplied input is not properly encoded, permitting script injection that executes in visitors’ browsers.

The WP Grids EasyTest – Simplify A/B Testing plugin, all releases up through version 1.0.1, is affected. Any WordPress site that has the plugin installed in those versions is at risk.

The CVSS score of 7.1 classifies the flaw as high severity. The EPSS score of < 1 % indicates a low overall exploitation probability at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is DOM‑based, an attacker can trigger it via a crafted HTTP request that injects an XSS payload into the plugin’s input fields; no authentication is required, so any user capable of submitting data can exploit it.