This vulnerability is an unauthenticated Cross-Site Scripting (XSS) issue in WP Debugging versions up to 2.12.2. It arises from improper neutralization of input during web page generation (CWE-79), allowing attackers to inject malicious scripts that execute in the context of the victim's browser. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability at low levels with scope changed.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially allowing attackers to steal sensitive information, manipulate content, or disrupt availability. Because the vulnerability is exploitable without authentication, it poses a significant risk to sites using vulnerable versions of WP Debugging.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or removing the WP Debugging plugin if not essential. Monitor official channels for updates from the vendor regarding patches or mitigations.