The vulnerability is a DOM‑based Cross‑Site Scripting flaw where attacker‑controlled input is not properly neutralised before rendering in the browser. Because the flaw resides in the front‑end rendering code, a malicious user could inject arbitrary JavaScript into the page, potentially leading to cookie theft, session hijacking or defacement of the site. The weakness is identified as CWE‑79 – Improper Neutralization of Input During Web Page Generation.

The affected product is the WordPress "Font Awesome WP" plugin developed by farjana55. All installations of the plugin with versions from its earliest release up to and including version 1.0 are vulnerable. No specific affected version strings were provided beyond the "<= 1.0" indication.

The CVSS score of 6.5 indicates a medium risk level, while the EPSS score of less than 1% suggests that exploitation is currently uncommon. The vulnerability is not listed in the CISA KEV catalog. Attacks would likely be carried out through crafted URLs or user‑submitted data that cause the plugin to reflect the input in the DOM without proper encoding, allowing the execution of arbitrary scripts in the context of any user who views the affected page.