The vulnerability is a DOM‑based XSS flaw caused by improper neutralization of user input before rendering in a web page. An attacker can inject arbitrary JavaScript into the page, which executes in the context of the victim’s browser. The weakness is identified as CWE‑79 and can lead to malicious scripts running on the client side.

WordPress sites that run the JetSearch plugin version 3.5.16 or earlier are affected. The plugin, released by Crocoblock under the JetSearch name, is vulnerable from its earliest version through 3.5.16. No specific WordPress core or theme versions are indicated as impacted.

The CVSS score of 6.5 reflects a moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation at the present time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires a victim to visit a maliciously crafted URL or submit input that the plugin fails to sanitize, which is inferred from the description of a DOM‑based XSS flaw. Given these factors, the overall risk is considered moderate but with a low expected exploitation rate.