Improper neutralization of input during web page generation in CridioStudio ListingPro Lead Form allows an attacker to inject malicious JavaScript that executes in the victim’s browser. The resulting DOM‑Based XSS can enable session hijacking, defacement, or unauthorized access to data stored or displayed by the site.

ListingPro Lead Form plugin from version 1.0.7 and earlier is affected. The vulnerability applies to all installations of the plugin on WordPress sites where the form receives user‑supplied input and displays it without proper escaping.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and the issue is not listed in CISA’s KEV catalog. The attack vector most likely involves presenting a crafted URL or form input that the plugin naïvely injects into the page’s DOM, allowing an attacker‑controlled script to run in the context of the site’s origin.