This vulnerability presents a DOM‑based reflected cross‑site scripting flaw in the WordPress 'Limit Max IPs Per User' plugin. The plugin fails to neutralize user‑supplied input before rendering it in the browser, enabling attackers to inject malicious scripts that execute within the victim's browser context. Such code execution can lead to session hijacking, credential theft, or site defacement. The flaw aligns with CWE‑79, improper input sanitization.

The affected software is the 'Limit Max IPs Per User' plugin developed by ralxz. All releases from the initial version through (and including) 1.5 are susceptible. WordPress sites running any of these versions and having the plugin active are at risk.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The issue is not listed in CISA's KEV catalog. Exploitability requires that the plugin be enabled and the victim visit a URL or input that triggers the XSS. Attackers can craft malicious links or input that will execute arbitrary JavaScript in the victim's browser.