Improper Neutralization of Input During Web Page Generation (CWE‑79) allows DOM‑Based XSS in the RPS Include Content WordPress plugin. The attacker can inject client‑side scripts that run in a victim’s browser when the plugin renders content. Based on the description, it is inferred that the attacker could potentially leverage these scripts for actions such as cookie theft, defacement or session hijacking. The vulnerability resides in the plugin’s processing of user‑controlled data without proper escaping.

The affected product is the WordPress plugin RPS Include Content from the vendor redpixelstudios, with all versions up to and including 1.2.1 susceptible to the XSS flaw.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% suggests the likelihood of exploitation at the time of analysis is low. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed large‑scale exploitation. Based on the description, it is inferred that likely attack vectors involve an attacker crafting a link or content that triggers the vulnerable code in the browser of a user who interacts with the plugin’s output.