The vulnerability is an improper neutralization of input during web page generation, leading to a DOM‑Based XSS flaw. An attacker can inject malicious JavaScript that will execute in the browser context of any user who views a page rendered by the WP Responsive Auto Fit Text plugin. This allows the attacker to hijack sessions, steal credentials, or modify the page content, thereby compromising confidentiality, integrity and availability of the affected site.

WordPress installations that use the WP Responsive Auto Fit Text plugin version 0.2 or earlier are affected. The plugin is available from the WordPress plugin repository and is integrated into the WordPress editor as an add‑on for responsive text scaling.

The CVSS base score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests that the probability of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is user‑initiated interaction: an attacker injects code into a field that the plugin renders into the page’s DOM. If the vulnerable plugin is activated, any visitor to the site would execute the attacker‑controlled script.