WordPress Templatera plugin contains a DOM‑based cross‑site scripting flaw caused by improper neutralization of user input during page rendering. A malicious actor can inject arbitrary JavaScript that executes in the browser context of any site visitor, potentially allowing theft of session data, credential hijacking, or defacement of the user interface. The vulnerability exploits a failure to escape or filter content injected by the plugin, and the injected script runs with the privileges of the page’s original authorizations. This results in confidentiality and integrity risks to end users and can be leveraged for further attacks such as phishing or malware delivery.

The vulnerability affects the Templatera plugin supplied by wpbakery. Versions from the initial release through 2.3.0 are impacted. Any WordPress installation running this plugin within that version range is susceptible.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of < 1 % suggests a low probability of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve an attacker submitting a crafted payload through the plugin’s input fields that are rendered without proper sanitization. Successful exploitation requires the plugin to be active and the attacker to be able to supply or influence the input data displayed to unsuspecting users.