The vulnerability is a DOM‑Based Cross‑Site Scripting flaw in the Menu In Post WordPress plugin. An attacker can inject malicious JavaScript that will execute when a user views a post that contains the plugin, allowing the attacker to run arbitrary code in the victim’s browser. The vulnerability results from improper sanitization of user input before rendering the page. While the CVE description does not list specific downstream effects, it is inferred that the ability to execute code in the client context could enable session hijacking, data theft, or content defacement; these consequences are typical outcomes of XSS but are not directly stated in the CVE.

This issue affects the WordPress plugin Menu In Post from vendor linux4me2, for all releases up to and including version 1.4.1. Any WordPress site that has installed a vulnerable version of the plugin is at risk. Versions newer than 1.4.1, if released, presumably contain the fix.

The base CVSS score of 5.4 classifies the vulnerability as moderate, and the EPSS score of less than 1 % suggests a low likelihood of widespread exploitation at present. The attack vector is client‑side DOM manipulation and does not require authentication; any user who views a post containing attacker‑sourced input could be impacted. The vulnerability is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation. Given these metrics, administrators should treat the same as a moderate risk that warrants prompt remediation.