The vulnerability arises from improper neutralization of user input when generating web pages. The Aparat Responsive plugin constructs DOM elements from unsanitized data, allowing an attacker to inject malicious JavaScript. Successful exploitation enables arbitrary client‑side code execution, potentially resulting in credential theft, session hijacking, or site defacement. The weakness is classified as a client‑side XSS (CWE‑79).

The flaw affects the Aparat Responsive plugin developed by mkkmail, in all releases up to and including version 1.3. Any WordPress installation using these versions is susceptible; no other products or newer versions are impacted by the described issue.

The CVSS score of 6.5 indicates a medium‑to‑high risk level. The EPSS score of less than 1% suggests that, despite the vulnerability's presence, the probability of exploitation remains low. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread attacks yet. Exploitation typically requires a client to process a crafted URL or content that sets malicious DOM nodes, making social engineering or compromised user traffic a likely attack vector. Given the client‑side nature, the impact is confined to the victim’s browser context, but can be leveraged to exfiltrate sensitive data or perform actions on behalf of the user.