The WordPress ID Arrays plugin is vulnerable to DOM‑Based XSS. An attacker can supply crafted input in a POST request that is reflected into the web page without proper neutralization, allowing execution of arbitrary JavaScript in the context of the victim’s browser. This flaw is a classic input validation weakness (CWE‑79) and can lead to session hijacking, defacement, or phishing attacks. The impact is confined to the application scope and affects the confidentiality and integrity of user sessions, but it does not provide direct server‑side code execution.

WordPress sites that use the harman79 ID Arrays plugin, version 2.1.2 or older. The vulnerability applies to all installations of this plugin regardless of other configuration details.

The CVSS score of 7.1 indicates high severity. The EPSS score is below 1%, suggesting a low probability of current exploitation, and the flaw is not listed in CISA KEV. However, browsers that load untrusted POST data may be vulnerable, and an attacker can easily craft a malicious request to trigger the XSS. The likely attack vector is a crafted web request to the plugin’s endpoint, usually by embedding a malicious link or form in a third‑party site accessible to target users.