Improper neutralization of input during web page generation results in a DOM‑based Cross‑Site Scripting vulnerability. An attacker can inject malicious JavaScript that is executed when a victim visits a crafted page or submits a specially crafted form. The vulnerability is described by CWE‑79 and can compromise confidentiality and integrity by executing code in the victim’s browser, potentially allowing session hijacking, data theft, or defacement.

The vendor Seb’s WP DPE‑GES plugin for WordPress is affected. All released versions up to and including 1.6 are vulnerable. No specific patch version is listed for newer releases beyond 1.6, but the advisory recommends updating to any version greater than 1.6.

The CVSS v3.1 base score is 6.5, indicating a medium‑to‑high risk. The EPSS score is less than 1%, which implies a very low likelihood of exploitation in the current environment. The vulnerability is not listed in CISA’s KEV catalog. An attacker would likely trigger the issue by creating a URL or form input that contains malicious scripts, which then gets executed in the context of the victim’s browser without any authentication or privileged access. While the attack surface is broad, the low exploitation probability reduces immediate urgency.