Improper neutralization of user supplied data within the PostX plugin leads to a DOM‑based XSS flaw. Attackers can inject malicious code that runs in the context of a victim’s browser. This allows theft of cookies, session hijack, defacement, or other client‑side abuse without needing server‑side changes.

WordPress sites that use the PostX plugin, versions prior to and including 4.1.25, under the WPXPO:PostX vendor. Sites hosting the plugin’s configuration or custom post content are impacted.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score is below 1 %, suggesting a low probability of public exploitation at present, and the flaw is not listed in the CISA KEV catalog. Exploitation would require an attacker to supply crafted content that the plugin renders in the browser, typically through a form or shortcode entry that is not properly sanitized. The attack vector is client‑side DOM manipulation, meaning the victim must load a page that includes the crafted payload.