The vulnerability is a DOM‑based Cross‑Site Scripting flaw in the Advanced FAQ Manager plugin for WordPress. It allows an attacker to inject and execute arbitrary scripts in the browser context of any user who views a compromised FAQ page. This can lead to unauthorized script execution, which could compromise user credentials, perform actions on behalf of the victim, or steal sensitive information.

The flaw affects the ThemeHigh Advanced FAQ Manager plugin for WordPress, impacting all released versions up to and including 1.5.2. WordPress sites that use this plugin and have not applied the official fix are vulnerable.

The CVSS score is 6.5, indicating a moderate severity. The EPSS score is reported as less than 1%, suggesting a very low immediate likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires a malicious input that is reflected into the DOM, likely via plugin settings or FAQ content. While the CVE does not describe a network‑bypass or privilege escalation, the impact remains significant for visitors who load the affected pages.