CVE-2026-24948

A reflected cross-site scripting (XSS) vulnerability exists in the WordPress Reflector plugin versions through 1.2.2. The issue stems from improper neutralization of user-supplied input during web page generation, allowing attackers to inject arbitrary HTML and JavaScript.

Exploitation requires user interaction, such as clicking a crafted link or visiting a specially prepared page. The vulnerability can be triggered by both authenticated and unauthenticated users, though administrative privileges are not required for the initial attack. This makes it suitable for mass exploitation campaigns targeting thousands of sites.

Successful exploitation enables an attacker to execute malicious scripts in the context of the victim's browser. This can lead to redirection to attacker-controlled sites, injection of advertisements, theft of sensitive data, or defacement of the website. The CVSS score of 7.1 reflects the moderate severity and potential for widespread abuse.

The vulnerability has been fixed in version 1.2.3. Users are strongly advised to update immediately. For those unable to update, Patchstack provides a mitigation rule that blocks attacks until a patched version is applied [1].