The vulnerability is a DOM‑Based Cross‑Site Scripting flaw caused by the plugin’s failure to neutralize user input before rendering it in a web page. When triggered, an attacker can inject and execute malicious scripts in the context of a victim’s browser, leading to potential session hijacking, cookie theft, defacement, or other client‑side attacks. The weakness is classified as CWE‑79, which underscores the lack of proper input sanitization.

The issue affects the Jannah – Extensions plugin developed by TieLabs, versions from the initial release up to and including 1.1.4. The plugin is used within WordPress environments, so any WordPress site deploying a vulnerable version is at risk.

The CVSS score of 6.5 places the vulnerability in the moderate severity range. The EPSS score of less than 1% indicates a low but non‑zero likelihood of exploitation at the time of analysis. The plugin is not listed in the CISA KEV catalog. Given that DOM‑Based XSS typically requires a victim to visit a crafted URL or interact with unsanitized input, the likely attack vector is a remote, user‑initiated attempt to exploit the plugin’s input handling.