The Taskbuilder WordPress plugin prior to version 5.0.8 fails to sanitise a URL parameter that is echoed into inline JavaScript on pages containing its shortcode. A crafted request can inject arbitrary script that executes in the browser context of any logged‑in user, enabling session hijacking, cookie theft, or further exploitation of the site.

All installations of the Taskbuilder plugin that are running a version earlier than 5.0.8 are vulnerable. No additional vendor or product details are specified beyond the plugin name and the affected major release.

The CVSS score of 7.1 indicates a high severity vulnerability. The EPSS score is below 1 %, suggesting a low probability of exploitation at present, and the flaw is not currently listed in the CISA KEV catalog. The typical attack route involves a victim clicking a crafted link or visiting a specifically formed URL that contains malicious payloads; once the logged‑in user renders the page, the script executes. Because the flaw does not require elevated privileges, every authenticated user is at risk, and the impact is limited to the client side of the application.