Improper neutralization of user‐generated input during web page rendering creates a DOM‑based cross‑site scripting flaw. When a victim visits a crafted URL or submits a malicious form, the plugin’s code injects arbitrary JavaScript into the page, enabling an attacker to steal session cookies, deface the site, or redirect users to malicious domains. The vulnerability is classified as CWE‑79.

WordPress sites that have installed the Churel plugin from Themeix, including all releases through version 1.0.8. Any user visiting a page that renders the plugin’s output can be exposed to the flaw.

With a CVSS score of 6.5 the flaw is of moderate severity, but the EPSS score of <1% indicates a low probability of exploitation in the wild, and it is not currently listed in the CISA KEV catalog. The exploit requires a user to load a vulnerable page—typically a crafted link or form submission—so an attacker can trigger code execution by delivering malicious input to the plugin’s processing logic.