The WordPress Theme Junkie Team Content plugin contains an improper neutralization of input during web page generation, leading to a DOM‑based cross‑site scripting vulnerability. This flaw permits an attacker to inject arbitrary JavaScript that executes in the victim’s browser when the plugin’s content is rendered.

WordPress sites that have the Theme Junkie Team Content plugin installed in version 0.1.1 or earlier. The plugin is distributed by the vendor Theme Junkie under the product name Theme Junkie Team Content.

The CVSS score of 6.5 indicates a moderate impact, and the EPSS score of less than 1 % shows a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could supply crafted input that is reflected in the plugin’s output, which a victim must view in their browser for the script to run. Therefore the attack vector requires user interaction or content injection through the plugin’s interface, and while the likelihood of exploitation is currently low, the risk remains moderate due to the potential impact of client‑side code execution.