The Domain For Sale WordPress plugin contains a stored Cross‑Site Scripting flaw triggered by the class_name parameter in all releases up to and including 3.0.10. The vulnerability is caused by insufficient sanitization of this parameter and failure to escape output, allowing an authenticated user with Contributor level or higher to inject arbitrary JavaScript into a Gutenberg block. When an affected page is viewed, the injected script runs in the context of the visitor’s session, providing opportunities for defacement, session hijacking, and the theft of sensitive data. This issue is classified as CWE‑79.

The affected product is the Domain For Sale plugin, developed by themeatelier, for WordPress. All released versions up to and including 3.0.10 are vulnerable; versions 3.0.11 or newer contain the fix.

The vulnerability has a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1 %, pointing to a low probability of exploitation in the near term. It is not listed in the CISA KEV catalog. The attack vector requires authenticated access at the Contributor role or higher, so the threat is contained to privileged users. Nevertheless, because injected scripts execute for any visitor, the potential impact on confidentiality, integrity, and availability can be significant if an attacker gains such access.