The FancyPost WordPress plugin contains an improper neutralization of user input during web page generation, allowing a DOM‑based XSS flaw in its post‑block component. The vulnerability permits an attacker to craft content that, when rendered by the plugin, injects malicious JavaScript which will be executed in any visitor’s browser that accesses the affected page. This flaw falls under CWE‑79 and can be used to steal credentials, deface the website, or launch phishing attacks.

The affected software is the Pluginic FancyPost WordPress plugin version 6.0.1 and all earlier releases. Sites that have installed this plugin and enabled its post‑block component are potentially vulnerable; newer versions released after 6.0.1 are not impacted.

With a CVSS score of 6.5, the flaw is evaluated as moderate severity. The EPSS score of less than 1 percent indicates a low likelihood of widespread exploitation at present. The likely attack vector is a web‑based interaction that triggers rendering of user input, and the need for authentication is inferred as none because the exploit can be triggered by any visitor. The impact is confined to the victim’s browser environment, and the vulnerability is not listed in the CISA KEV catalog.