The Simple Post Expiration plugin contains an improper neutralization of input that allows malicious data to be reflected into the browser’s document object model. This DOM‑based cross‑site scripting can enable an attacker to execute arbitrary JavaScript within the context of a victim’s browser, potentially exposing data, hijacking sessions, or defacing the site. The impact is limited to the browser context and relies on the victim viewing the output generated by the plugin.

WordPress installations that have the Simple Post Expiration plugin by Syed Balkhi installed in version 1.0.1 or earlier are affected. The vulnerability applies from the plugin’s initial release through the 1.0.1 release, as indicated by the affected‑version range in the CVE.

The CVSS score of 6.5 classifies the issue as medium severity, while the EPSS score of less than 1 % suggests a very low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack likely requires an adversary to supply crafted input via the plugin’s configuration or data fields, which is then rendered client‑side, allowing the malicious script to run in visitors’ browsers.