Improper neutralization of input during web page generation permits attackers to inject malicious JavaScript into pages rendered by the LABCAT Processing Projects plugin. This DOM‑based cross‑site scripting can lead to theft of user session cookies, in‑page defacement, or the execution of arbitrary code in the victim’s browser, compromising data confidentiality and integrity for users who view the affected pages.

The vulnerability affects all installations of the Processing Projects WordPress plugin with versions from the initial release through and including 1.0.2. No newer versions are currently known to be affected.

The CVSS score of 6.5 indicates moderate severity, and the EPSS <1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to load a page that includes processed input from the plugin; the attacker can inject malicious scripts that execute in the victim’s browser context. The risk is moderate but mitigated by the low likelihood of active exploitation.