An attacker can leverage a DOM‑based Cross‑Site Scripting flaw in Alleythemes Home Services to inject malicious scripts into the web page. Because the plugin fails to properly neutralize user input during page rendering, a crafted payload can execute in the victim’s browser, potentially leading to session hijacking, credential theft, or defacement. The weakness aligns with CWE‑79, a classic XSS vulnerability.

WordPress sites running the Home Services plugin from any release before and including version 1.2.6 are affected. The vulnerability originates from allelethemes’ Home Services plugin and impacts users who have not updated to a patch that addresses the input sanitization issue.

The CVSS score of 6.5 indicates medium severity, while the EPSS score of <1% suggests a low exploitation probability at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers would likely trigger the flaw by supplying malicious data through the plugin’s exposed input fields or by manipulating the URL, leading to script execution in the victim’s browser. Given the DOM‑based nature, local or remote code execution depends on the ability to inject content via the plugin’s interface.