The vulnerability is a DOM‑based cross‑site scripting flaw caused by improper neutralization of user input during web page generation. It lets an attacker inject malicious script into pages viewed by users, enabling session hijacking, credential theft, or site defacement. This weakness is catalogued as CWE‑79.

The affected application is the WordPress Dropshix plugin developed by Xolluteon. Versions up to and including 4.0.14 are vulnerable, so any site that uses that release of the plugin is at risk.

The CVSS score of 7.6 indicates a high severity. The EPSS score of less than 1 % suggests exploitation is unlikely but possible, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted URL or abusive input that triggers client‑side script execution in the browser; attackers would need to lure a victim into visiting a page containing the malicious payload. While exploitation is currently uncommon, the high severity warrants prompt action to prevent potential compromise.