This vulnerability arises from improper neutralization of user input during web page generation, allowing an attacker to inject script that is reflected back to the victim. The resulting reflected XSS can be used to deface a site, steal session cookies, or execute arbitrary JavaScript in the context of authenticated users. Vulnerability is rooted in CWE‑79, reflecting a classic input validation flaw that compromises confidentiality and integrity of the affected plugin.

The flaw exists in the WordPress plugin DK White Label supplied by dinamiko. All installations of version 1.0 or earlier are affected; newer releases are not listed as vulnerable.

The CVSS score of 7.1 indicates high severity. The EPSS score of less than 1% suggests low probability of exploitation at the time of reporting, and the vulnerability is not marked in the CISA KEV catalog. The likely attack vector is through a malicious URL that delivers crafted input to the vulnerable endpoint, making the exploitation straightforward for an attacker with web access.