An improper neutralization of input during web page generation allows a DOM‑based cross‑site scripting vulnerability in the Genetech Products Web and WooCommerce Addons for WPBakery Builder plugin. The flaw permits an attacker to inject malicious JavaScript that runs in the victim’s browser, potentially enabling session hijacking, defacement, or phishing attacks. The weakness is identified as CWE‑79 and does not enable remote code execution on the server.

The vulnerability impacts the WordPress plugin “Web and WooCommerce Addons for WPBakery Builder” supplied by Genetech Products. All installed copies of the plugin with a version identifier of 1.5 or lower are affected; versions beyond 1.5 are presumed not vulnerable.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of less than 1 % suggests a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers would typically trigger the flaw by tricking a browser into loading the affected page, meaning the attack vector is client‑side. While the exploit does not compromise server resources directly, a successful XSS payload can lead to credential theft or malicious actions performed in the victim’s context.