The vulnerability arises from improper neutralization of user input during web page generation within the Hash Elements plugin. An attacker can embed malicious script into content that the plugin outputs, and when visitors load the affected page the injected code runs in their browsers, allowing the attacker to steal session cookies, deface the page, or redirect users to malicious sites. This client‑side XSS compromises the confidentiality, integrity, and availability of the site from a user’s perspective.

All releases of the Hash Elements plugin distributed by hashthemes up to and including version 1.5.0 are affected. WordPress sites running any of those versions are vulnerable unless the plugin is updated or removed.

The CVSS score of 6.5 classifies the issue as moderate severity. The EPSS score of less than 1 % indicates the current exploitation probability is low, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a crafted value that the plugin incorporates into the page output, which is then executed by browsers that visit the page.