The IssueM WordPress plugin contains a DOM‑based XSS flaw caused by improper neutralization of input during web page generation. The vulnerability allows an attacker to inject malicious JavaScript that is reflected into the browser's DOM, potentially enabling client‑side attacks. This weakness is a classic input‑validation issue identified as CWE‑79.

All installations of the ZEEN101 IssueM plugin from its initial release through version 2.9.0 are affected. Any user on a site running one of those releases may be vulnerable to a DOM‑based XSS attack.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of less than 1 % suggests a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves an attacker providing crafted input—such as data entered into a form field or a URL parameter—that the plugin echoes into the DOM, leading to execution of the injected script.