This vulnerability is a DOM‑based cross‑site scripting (XSS) flaw that allows an attacker to inject malicious scripts into web pages generated by the SecuPress Free plugin. The flaw arises from the plugin’s failure to properly neutralize user‑controllable input during page rendering. Because the injected script runs in the context of a victim’s browser, an attacker could potentially execute arbitrary client‑side code when a user visits a page processed by the plugin.

The SecuPress Free plugin, provided by SecuPress, is affected in all releases from the initial version up through 2.2.5.3. Any site running the plugin at or below this version is at risk.

The CVSS base score is 6.5, indicating a moderate severity vulnerability. The EPSS score is less than 1%, suggesting that the likelihood of exploitation in the wild is very low, and it is not listed in the CISA KEV catalog. The weakness is a DOM‑based XSS (CWE‑79), which typically requires an attacker to craft a malicious URL or input that the user must load or interact with. The attack can be carried out by inserting a script that will run in the victim’s browser, allowing the attacker to steal session data or deface the site if the user interacts with the malicious content.