The Omnipress plugin version 1.6.4 and earlier contain a DOM‑based cross‑site scripting flaw caused by insufficient input neutralization during web page generation. A malicious actor can craft a URL or otherwise influence the victim’s browser to execute arbitrary JavaScript in the context of the Omnipress site, potentially allowing session hijacking, cookie theft, defacement, or other client‑side attacks. This flaw is a classic example of CWE‑79, where untrusted input is reflected into the page without proper sanitization.

Affected software is the Omnipress plugin produced by the Omnipressteam authors. All releases up to and including version 1.6.4 are impacted; no later releases are listed as affected.

The CVSS v3 score of 6.5 indicates a moderate severity. The EPSS score of less than 1% and no listing in the CISA KEV catalog suggest that the likelihood of widespread exploitation is low at present. The attack requires a victim’s browser to process the crafted input, typically via a malicious link or embedded content. Once a susceptible user visits the affected page, the injected script runs with the user’s privileges. No remote server‑side code execution or denial of service is disclosed.