This vulnerability is a DOM‑based Cross‑Site Scripting flaw that allows an attacker to inject arbitrary JavaScript into pages generated by the WP ViewSTL plugin. The flaw arises from the plugin’s failure to properly neutralise user‑supplied input before rendering it in the browser. A successful exploitation would let an attacker execute scripts in the context of the victim’s browser, potentially leading to session hijacking, defacement, or theft of sensitive information stored in the user’s session.

The issue affects the falldeaf WP ViewSTL WordPress plugin with versions up to and including 1.0. Any WordPress site that has a vulnerable instance of this plugin installed is at risk.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% shows that the likelihood of exploitation is very low at present. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw is DOM‑based, the attack vector is presumed to be a crafted URL or form input that the plugin does not sanitise before rendering on the page. No additional prerequisites are noted, making the exploit potentially straightforward for a sufficiently motivated attacker.