This vulnerability is a DOM‑based cross‑site scripting flaw that allows an attacker to inject and execute arbitrary JavaScript in the browser of visitors who load the affected private archive pages. The injection can lead to session cookie theft, defacement of the site, or redirection to malicious sites, thereby compromising user confidentiality and integrity of the site’s displayed content.

The flaw affects the WordPress plugin "Archive Page" developed by Alobaidi, specifically versions up to and including 1.0.2. Any WordPress installation that has this plugin in use and has not been upgraded to a later release is vulnerable.

The CVSS score of 6.5 indicates a moderate impact, while the EPSS score of less than 1% suggests that exploitation is expected to be rare at the moment. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw by convincing a victim to visit a crafted URL that includes malicious input, which will be executed in the victim’s browser when the page loads. Because it is a DOM‑based flaw, the attack requires user interaction but does not require further network privileges or server access.