The RAphicon WordPress plugin suffers from improper neutralization of user input during web page generation, specifically a DOM‑based XSS flaw. This weakness allows an attacker to inject malicious JavaScript into a page delivered to a visitor, potentially hijacking user sessions, defacing content, or exfiltrating data from the browser context. No elevation of privilege is required, so the primary impact is confidentiality or integrity compromise for users who view affected pages.

The vulnerability is present in all releases of the RAphicon plugin up to and including version 2.1.2, distributed by Rahendra Putra K™. Sites running any of these versions of the plugin are exposed.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of <1% suggests low current exploitation probability. The flaw is not listed in CISA’s KEV catalog. It is likely that an attacker can exploit this vulnerability by injecting script content into any page that renders untrusted input; the attack vector would most typically be a compromised or malicious user visiting a site with the plugin enabled. In the absence of an official patch, the risk remains until remediation is applied.