Arraytics Booktics, a WordPress plugin, contains an Improper Neutralization of Input During Web Page Generation vulnerability that manifests as a DOM‑based XSS flaw. The flaw allows malicious scripts to be injected into the browser context of any user who interacts with the affected functionality. This can lead to a range of client‑side attacks such as credential theft, session hijacking, defacement of the site’s appearance, or the execution of arbitrary JavaScript on the user’s machine, thereby compromising confidentiality, integrity, and availability at the client level.

The vulnerability affects the WordPress Booktics plugin provided by Arraytics, versions from the original release through 1.0.29. Any WordPress installation that has this plugin installed and exposed to end users is susceptible.

The CVSS score of 7.1 places the issue in the high severity range, indicating a significant threat if exploited. The EPSS score is not available, but the absence of KEV listing suggests that there have been no confirmed mass‑scale exploit incidents publicly reported to CISA. Inferred from the nature of DOM‑based XSS, the attack vector is web‑based and can be triggered by any user who can access the vulnerable page or provide crafted input. The typical exploitation scenario is a malicious actor embedding script payloads in URLs or form fields that the plugin fails to sanitize, leading to immediate client‑side script execution.