The vulnerability is an Improper Neutralization of Input During Web Page Generation (CWE‑79) that allows DOM‑Based cross‑site scripting by the WordPress LeadConnector plugin. When untrusted data entered through the plugin is inserted into the page without proper encoding, a malicious script can be executed in the context of any user who visits the affected page. This may compromise the confidentiality of user data, allow the attacker to hijack the user’s session, or deface the site.

All installations of the LeadConnector WordPress plugin with a version number of 3.0.2 or earlier are affected. The vendor is LeadConnector and the product is the LeadConnector plugin for WordPress. No specific sub‑versions are listed; the issue exists from the initial release through <=3.0.2.

The CVSS score of 6.5 indicates a medium impact. The EPSS score of less than 1% suggests that exploitation is currently unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalogue. Exploitation is likely to occur via a normal web request to a page rendered by the plugin, and therefore a site’s public web interface is the main attack surface. An attacker needs only to entice a user to view the vulnerable page; no special credentials are required.