The vulnerability is a DOM‑based cross‑site scripting flaw caused by improper neutralization of input during web page generation in the Aptivada for WP WordPress plugin up to version 2.0.0. An attacker who can supply crafted data that the plugin incorporates into the rendered page could cause a victim’s browser to execute arbitrary JavaScript. This could lead to theft of session cookies, phishing, or defacement of the site as seen by users who view the malicious content.

Affected by the Aptivada for WP plugin, released by aptivadadev. All installations running version 2.0.0 or earlier are vulnerable. The plugin extends WordPress with various newsletters or automation features, but the exact scope is limited to the plugin’s output routines.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of active exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation would likely require a user to visit a crafted page or input malicious data that the plugin processes. Because the weakness is DOM‑based XSS, mitigations include browser‑side defenses such as a strong content‑security‑policy. However, the low EPSS indicates that, at present, the attack vector is not frequently used by attackers.