Improper neutralization of user input during web page generation allows DOM‑based XSS in the codegearthemes Designer plugin. An attacker can craft malicious input that will be executed within the victim’s browser, potentially enabling session hijacking, cookie theft, defacement, or execution of arbitrary JavaScript. The flaw does not provide native remote code execution on the server but can lead to serious client‑side compromise.

All WordPress installations running codegearthemes Designer plugin version 1.6.4 or earlier are affected. The vulnerability applies to every instance of the plugin, regardless of additional WordPress configurations.

The CVSS score of 6.5 indicates moderate severity. The EPSS is < 1%, showing an extremely low current exploitation probability. The attacker would need to lure a user to a URL or form containing malicious payloads, so the attack vector is user‑interaction‑dependent. The vulnerability is not included in the CISA KEV catalog, further reflecting its limited real‑world exploitation at present. However, when exploited it can undermine user trust and compromise site data. This combination of moderate severity, low exploitation likelihood, and client‑side impact represents a noticeable but manageable risk for organizations.