Improperly neutralized input during web page generation allows an attacker to inject malicious JavaScript into the Progress Tracker plugin interface. The vulnerability is a DOM‑based XSS that can execute arbitrary client‑side code when an affected user visits a crafted link or interacts with vulnerable input fields. An attacker could perform session hijacking, defacement, or phishing by delivering the attacker’s script inside the plugin’s output.

WordPress Progress Tracker plugin, versions up to 0.9.3, supplied by Alex Furr. The issue exists in all releases from the initial deployment through 0.9.3 inclusive.

The CVSS score of 6.5 indicates a medium‑severe risk. The EPSS score is below 1 %, suggesting that automatic exploitation is unlikely but still possible if an attacker can entice users to visit a malicious URL. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires a victim to load the victim‑containing page; an attacker can typically influence the URL or form input that the plugin processes, making the attack vector “client‑side” and dependent on user interaction.