The DirectoryPress plugin for WordPress contains an improper neutralization of input during web page generation, allowing DOM-based cross‑site scripting (XSS). This flaw corresponds to CWE‑79, Improper Neutralization of Input During Web Page Generation. This flaw lets an attacker inject malicious JavaScript into a page viewed by other users, which can be used to hijack sessions, steal cookies, deface content, or execute arbitrary commands in the context of the website. The vulnerability affects the plugin up to version 3.6.25 and poses a moderate to high risk due to the potential for widespread impact on any user interacting with the affected pages.

Designinvento DirectoryPress, a WordPress plugin available up to and including version 3.6.25. Any WordPress installation that uses this plugin version is susceptible.

The CVSS score of 6.5 indicates a moderate priority for remediation, while the EPSS score of less than 1% suggests the likelihood of exploitation is currently very low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remotely via the Web interface of a WordPress site; an attacker can craft a URL or form input that the plugin outputs without proper sanitization, triggering the DOM-based XSS. No additional prerequisites are stated, but the flaw requires a user to receive the malicious page, making it a typical web‑based XSS attack.