Improper neutralization of input during web page generation allows a DOM‐Based XSS in the WordPress plugin ShopCred. The flaw permits an attacker to inject arbitrary JavaScript into the page rendered for a user, potentially leading to cookie theft, session hijacking, or defacement, as is typical with XSS vulnerabilities. This issue is identified as CWE‑79 and results from unescaped user‑supplied data being inserted into the DOM.

ShopCred plugin for WordPress by devscred is affected. All versions from the earliest through 1.3.0 inclusive are vulnerable. No specific sub‑versions are listed beyond the <=1.3.0 bound.

The CVSS score of 6.5 indicates moderate severity, combining potential for data compromise with limited access requirements. EPSS indicates a very low probability of exploitation (<1 %), and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via crafting input or URLs that cause the victim’s browser to execute injected script, as typical for DOM‑Based XSS. Exploitation requires a user’s browser to process the malicious payload, making it user‑interaction dependent.