The Posts for Page plugin allows a DOM‑based Cross‑Site Scripting flaw due to improper neutralization of input during web page generation. A malicious input can be embedded in a post or page, and when the page is rendered, the payload is interpreted as JavaScript. This flaw may lead to unauthorized script execution, data theft, session hijacking, or defacement of the site content.

The vulnerability is present in the sihibbs Posts for Page WordPress plugin for all releases through version 2.1 inclusive. Any WordPress installation using this plugin version or earlier is affected and may host the vulnerable code. Users who have upgraded to 2.2 or later are not impacted.

With a CVSS score of 6.5, the flaw is classified as medium severity. The EPSS score of less than 1 % indicates a very low probability of exploitation at the time of this analysis, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is user‑directed; an attacker can craft a link or embed malicious content that, when accessed by a visitor, triggers the code in the victim’s browser. The impact is confined to the user’s session and the content rendered on the site rather than affecting the server’s integrity.