Improper neutralization of input during web page generation enables DOM‑Based XSS in the PluginsPoint Timeline Pro plugin. An attacker can inject malicious scripts that execute in the browsers of users who view the affected page, potentially stealing session cookies, defacing content, or redirecting to phishing sites. The flaw directly violates the input validation principle and can occur whenever untrusted data is reflected into the DOM without encoding, leading to confidentiality and integrity risks for site visitors.

The vulnerability affects the Timeline Pro WordPress plugin provided by PluginsPoint, versions from the earliest release up to and including 1.3. Users who have installed any of these versions are exposed unless mitigated or upgraded.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of < 1% shows low likelihood of widespread exploitation at present, and the issue is not listed in CISA’s KEV catalog. Inferred, the typical attack path involves an attacker creating or modifying a timeline entry that contains malicious script or redirect URLs, which a victim’s browser then processes. Successful exploitation requires the victim to load a page that contains the forged input, so social engineering or a compromised content editor may facilitate the exploit.