The Administrator Z plugin for WordPress contains a DOM‑based cross‑site scripting vulnerability that allows an attacker to inject arbitrary client‑side code into pages displayed to users. This flaw is caused by insufficient neutralization of user‑supplied input during web page generation and is classified as CWE‑79. If exploited, the attacker could run scripts that might steal session tokens, modify content, or redirect users, thereby compromising confidentiality, integrity, or availability for site visitors. The impact is limited to the browser context of affected users; the vulnerability does not allow remote code execution on the server.

The issue applies to the Administrator Z plugin developed by Quý Lê 91, affecting all releases up to and including 2026.03.02. WordPress sites that have installed this plugin without updating beyond that release remain vulnerable. No other WordPress plugins or versions are affected according to the available data.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is reported to be less than 1 %, suggesting a low but non‑zero likelihood of exploitation. The vulnerability is client‑side; the likely attack vector involves a specially crafted URL or page that triggers the DOM‑based XSS when a user visits it. The vulnerability is not listed in the CISA KEV catalog, meaning there are no confirmed large‑scale exploitation incidents reported yet, but the presence of a DOM‑based XSS flaw warrants timely attention.