The Easy Updates Manager WordPress plugin contains a reflected Cross‑Site Scripting flaw that allows an attacker to inject arbitrary web scripts via the un‑sanitised "paged" parameter in the pagination() function. Because the value is reflected back to the browser without proper escaping, clicking a crafted link can cause malicious code to execute in the context of an administrator’s session. This could lead to session hijacking, credential theft, or defacement of the site.

Affected products are the Easy Updates Manager plugin from David Anderson, versions up to and including 9.0.20. No newer versions are known to contain the issue. WordPress sites that have never updated the plugin beyond 9.0.20 remain vulnerable.

The CVSS score of 6.1 indicates a moderate impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation data. The attacker would need to convince an admin to visit a malicious URL that includes a crafted "paged" value, which is a social‑engineering requirement; the vulnerability is not exploitable without user interaction.