Unauthenticated Cross Site Scripting (XSS) exists in WordPress Convert Pro plugin versions 1.0.1 and earlier. The issue arises when user‑supplied input is rendered by the plugin without proper encoding, allowing an attacker to inject arbitrary client‑side script that runs in the browsers of visitors who view the affected content. This can lead to session hijacking, defacement, or delivery of malware to unsuspecting users, compromising the confidentiality, integrity, and availability of the site for end users.

The WordPress Convert Pro plugin (WP Grids:Convert Pro) on all WordPress sites installed with version 1.0.1 or earlier is impacted. Any site using those versions may be exposed until the plugin is upgraded to a patched release.

With a CVSS score of 7.1 the vulnerability is classified as high severity. The EPSS score is not available; however, the lack of authentication requirements means a remote attacker can trigger the vulnerability by submitting a crafted HTTP request to a page rendered by the plugin. The vulnerability is not listed in CISA KEV, so no known exploit has been tracked in that catalog. The straightforward nature of the payload and lack of constraints lower the technical barrier to exploitation compared to more complex vector types.