The vulnerability is an instance of improper neutralization of input during web page generation (CWE‑79). It allows an attacker to inject malicious script that is reflected back into the browser when a vulnerable request is made, potentially allowing arbitrary script execution in the victim's session context. The official description does not state any specific downstream effects, so only the documented impact is the possibility of executing malicious code in user browsers.

The vulnerability affects the WordPress Document Management System plugin “Document Management System” by reifsnyderb. All released versions from the earliest to and including 1.24 are vulnerable. No mention of subsequent versions is made.

The CVSS score of 7.1 indicates a moderate‑to‑high severity. The EPSS score of less than 1% suggests that exploitation is currently uncommon. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely reflected XSS, which typically requires an attacker to craft a URL or input that a victim will visit, posing a low barrier to exploitation. Existence of a lower EPSS score indicates that the vulnerability is not actively exploited in the wild at the time of the assessment.