The LJ comments import: reloaded plugin handles the PHP_SELF variable without proper sanitization or output escaping, creating two echo points that an attacker can manipulate to embed malicious scripts. An unauthenticated attacker can craft a URL that, when visited by a user, causes arbitrary client‑side code to run. The impact is the execution of injected scripts in the victim’s browser, potentially leading to session theft, defacement, or other downstream attacks.

The plugin "LJ comments import: reloaded" for WordPress, used by the etspring vendor, is affected in all releases up to and including version 0.97.1. No other versions are identified as vulnerable.

The CVSS score of 6.1 indicates a medium severity vulnerability. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, so a widespread exploitation is not documented. However, the vulnerability is exploitable via a crafted link, making it feasible for an attacker to deliver a reflected XSS payload to a user who follows the malicious URL. Overall the risk is moderate, and the likelihood of exploitation depends on the attacker’s ability to entice users to trigger the request.