The vulnerability arises from improper neutralization of user‑supplied input during web page generation in the Barn2 Plugins Document Library Lite plugin, which leads to a DOM‑based XSS condition. An attacker can inject malicious scripts that execute in the browsers of users who view pages rendered by the plugin, potentially enabling session hijacking, defacement, or data theft. The description indicates a scripting flaw, but no explicit statement about mitigation by standard sanitization is provided. The likely attack vector is an exploitable input field or URL parameter processed by the plugin, though the exact vector is not explicitly stated.

Barn2 Plugins Document Library Lite several WordPress sites that use the plugin version 1.1.7 or older. The CWE identified for this issue is CWE-79, representing a cross‑site scripting weakness.

The CVSS score is 5.9, indicating moderate severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation at the present time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to provide crafted input to the plugin; successful exploitation would allow the attacker to inject and run arbitrary JavaScript in the victim’s browser, leading to potential credential compromise or defacement.