The vulnerability is a DOM‑Based Cross‑Site Scripting (XSS) flaw caused by improper neutralization of input during web page generation in WPSight WPCasa. This weakness allows an attacker to inject malicious script that is executed in the context of a victim's browser. The impact is limited to the victim's session and browser, enabling actions such as cookie theft, session hijacking, or defacement of the page. The weakness corresponds to CWE‑79.

Vendor WPSight offers the WPCasa plugin, and all releases up to and including version 1.4.1 are affected. Newer releases (1.4.2 and later) have addressed the issue. No specific version range is given beyond the latest known vulnerable release.

The CVSS score of 6.5 indicates a medium severity level. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via malicious input that is reflected within the user interface of the plugin. The attacker requires a user to visit a crafted URL or submit manipulated parameters that are rendered in the browser.