The vulnerability involves improper neutralization of input during web page generation, allowing reflected cross-site scripting. An attacker can inject malicious scripts that will execute in the browsers of users who view a crafted URL, potentially stealing session cookies or defacing content. The weakness is classified as CWE-79 and could lead to compromise of user accounts and data confidentiality.

The affected product is Crocoblock JetBlog, WordPress plugin version 2.4.10 and earlier. No additional versions are listed as affected.

The CVSS score of 7.1 indicates high severity. EPSS data is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in CISA KEV. The likely attack vector is through user-controllable input in a web request that the plugin reflects without proper sanitization, as is typical for reflected XSS flaws.