The vulnerability is a DOM‑based Cross‑Site Scripting flaw that allows an attacker to inject malicious script into the web page when the plugin processes user input. An attacker could use this to hijack user sessions, exfiltrate data from the browser, or execute arbitrary client‑side code against any visitor who views the affected page.

WordPress sites running the Aphotrax Uptime Robot Plugin for WordPress versions up to and including 2.3 are impacted. The plugin is no longer supported beyond that release, and all sites using any 2.3‑or‑earlier build should apply the fix.

The CVSS score of 6.5 indicates a moderate severity. With an EPSS score below 1%, the likelihood of an exploit in the wild is low, and the vulnerability is not listed in the CISA KEV catalog. The attack requires a user to be tricked into visiting a crafted URL or entering malicious payloads that the plugin fails to neutralize, which would then execute in the victim’s browser. No publicly available exploit has been reported, but the nature of DOM‑XSS makes it trivially reproducible by a savvy attacker.