The vulnerability is a reflected Cross‑Site Scripting flaw that allows an attacker to inject malicious JavaScript into a victim’s browser. Because the plugin does not properly neutralize user input, a crafted request can cause arbitrary script to execute in the context of the site, potentially leading to session hijacking, theft of cookies, or defacement of the webpage. This flaw is identified as CWE‑79.

The flaw affects the UpSolution UpSolution Core WordPress plugin, versions up to and including 8.44. Any site that has this plugin installed and has not yet applied an update beyond 8.44 is vulnerable.

The CVSS score of 7.1 indicates a high level of risk. The exploitability is limited to reflected XSS, meaning an attacker must entice a user to click a malicious link or submit a specially crafted form. There is no evidence of active exploitation or inclusion in the CISA KEV list, and the EPSS value is not available, so the overall likelihood is moderate, but the potential impact on user sessions makes mitigation a priority.