Pierre Lannoy IP Locator plugin exposes a DOM‑based XSS flaw due to improper neutralization of user input during web page generation. As a result, an attacker can inject malicious scripts that execute in the victim’s browser, enabling session hijacking, credential theft, defacement, or other browser‑side attacks. The weakness is a classic cross‑site scripting vulnerability, classified under CWE‑79.

Any WordPress installation that has the IP Locator plugin version 4.1.0 or earlier is impacted. All releases prior to 4.1.0 are affected, including the initial release. Administrators should identify any such installations and evaluate their use of the plugin.

The CVSS score of 6.5 indicates a moderate severity. The EPSS < 1% suggests that currently the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by delivering crafted input that the plugin processes client‑side, meaning any user who views the affected page could be compromised. The risk is moderate but the probable exploit rate remains low.