The vulnerability arises from improper neutralization of user supplied input during web page generation, allowing DOM‑based XSS in the Content Control plugin. An attacker who can supply or influence data processed by the plugin can inject malicious scripts that execute in the browsers of visitors who view affected pages, potentially leading to session hijacking, data theft, or defacement.

This flaw affects the WordPress plugin Daniel Iser Content Control for all releases up to and including version 2.6.1. The plugin is commonly used to restrict content visibility; any site running this plugin within the affected version range is vulnerable.

The CVSS score of 6.5 indicates a medium severity. The EPSS score below 1% suggests a very low current likelihood of exploitation, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is likely through the WordPress front‑end or admin interface where untrusted input can be submitted to the plugin, with no requirement for privileged access, making it potentially exploitable by unauthenticated users.