Improper neutralization of input during web page generation (DOM‑Based XSS) allows an attacker to inject arbitrary JavaScript into a victim’s browser context when the mfolio‑lite plugin processes user‑supplied data. The CVE description does not specify particular outcomes, but execution of client‑side code can potentially lead to unauthorized actions performed within the victim’s browser.

The WordPress plugin mfolio‑lite from ThemerLooks, versions 1.2.3 and earlier, is affected.

The CVSS score is 6.5, indicating medium severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Exploitation can occur remotely by delivering a crafted URL or content that the plugin fails to sanitize. Because it is DOM‑based XSS, no server‑side code execution is required; an attacker simply needs a victim to view a page that incorporates the plugin.