The EntreDroppers WordPress plugin is vulnerable to reflected cross‑site scripting because the PHP_SELF variable is used without sanitization in the form action. An attacker who tricks a user into visiting a crafted URL can inject arbitrary JavaScript that the browser executes when the page loads. This flaw permits an unauthenticated attacker to run client‑side code with the user’s privileges, potentially stealing session cookies, defacing the site, or redirecting users to phishing pages. The weakness corresponds to CWE‑79.

The impact applies to the owencutajar EntreDroppers plugin for WordPress, affecting all versions up to and including 1.1.2. Administrators of sites that have this plugin installed should verify the plugin version and consider removing it if it cannot be updated.

The vulnerability has a CVSS score of 6.1, indicating moderate severity. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been documented. Nonetheless, because the flaw is triggered by a user clicking a link and does not require special privileges, the likelihood of exploitation remains high in environments where the plugin is used and the affected sites are publicly reachable. Malicious URLinfo data that is reflected verbatim into the form action attribute can force the victim’s browser to execute the injected script.