Improper neutralization of input during web page generation allows a DOM‑based cross‑site scripting vulnerability in the WP Data Access plugin. An attacker can craft a malicious request that introduces a script payload into the page rendered by the plugin, potentially executing arbitrary JavaScript in the context of the user’s browser. The weakness is identified as CWE‑79.

All installations of the Passionate Programmer Peter WP Data Access plugin from its first release through version 5.5.36 are affected. WordPress sites that have this plugin installed are vulnerable unless the plugin is upgraded beyond 5.5.36.

The vulnerability has a CVSS score of 6.5, indicating moderate severity. Its EPSS score is indicated as less than 1 %, suggesting a low likelihood of exploitation in the wild, and it is not currently listed in the CISA KEV catalog. The attack vector is inferred to be through user‑controlled input that is reflected into the browser DOM, so an attacker only needs to lure an authenticated or unauthenticated user to a crafted URL or form to trigger the script.