Improper neutralization of input during web page generation enables an attacker to inject malicious script into a victim browser. The flaw is a DOM‑based XSS that occurs when the Create with Code plugin processes user input without proper sanitization. If exploited, an attacker can execute arbitrary JavaScript in the context of the site, potentially hijacking sessions, defacing content, or directing users to malicious resources. The weakness is identified as CWE‑79.

The vulnerability affects the WordPress Create with Code plugin (pddring:Create with Code) versions from unpublished releases through 1.4. Site administrators running these versions should verify whether the plugin is installed and assess its version.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is less than 1 %, suggesting that exploitation is currently unlikely but possible. The issue is not listed in the CISA KEV catalog. Exploitation would require a victim to visit or interact with a page that includes the vulnerable input field; an attacker can then embed malicious script that is executed in the victim's browser context.