The lies in the Relentless Apps RRSSB WordPress plugin, which uses improper input neutralization during web page generation. An attacker can inject arbitrary scripts that execute in the browser context, enabling DOM‑based cross‑site scripting. Since the payload runs in the victim’s browser, it can steal session cookies, deface content, or perform other client‑side attacks, but it does not grant direct server‑side compromise.

The error affects the RRSSB plugin from the initial release up through version 1.0.1. Any WordPress installation running one of these versions and using the plugin is vulnerable. The plugin is distributed under Relentless Apps, and no other WordPress core or plugin components are impacted.

The CVSS score of 6.5 indicates a medium severity. The EPSS score of less than 1% suggests that widespread exploitation is unlikely as of the latest data. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is user interaction with blog content rendered by the plugin. Attackers could target high‑traffic sites, but currently the exploitation probability remains low.