The defect in the plugin allows unsanitized user input to be stored and later reflected in web pages, enabling attackers to inject malicious scripts that execute in the browsers of anyone who views the affected content.

The vulnerability applies to all installations of the Dadevarzan WordPress Common plugin with a version of 2.2.2 or older. Sites running WordPress and using this plugin in any capacity are at risk if they have not upgraded beyond the affected release.

The severity measured by a CVSS score of 6.5 indicates a moderate impact to confidentiality, integrity, and availability. The EPSS score of less than 1% suggests a low probability of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector requires the attacker to inject code through the plugin’s administrative interface, implying the need for at least weakly privileged access to the site’s back‑end. Once injection succeeds, any visitor to the affected page can be compromised.