The vulnerability is an improper neutralization of user input during web page generation, which allows an attacker to inject malicious JavaScript that is executed in the victim’s browser context when the vulnerable plugin renders the content. The flaw is classified as CWE‑79 and results in DOM‑Based XSS.

WordPress sites that use the Tutor LMS BunnyNet Integration plugin by Themeum with version 1.0.0 or earlier are affected. No specific fixed version is listed in the data, so the issue may still exist in any installation that has not been upgraded beyond 1.0.0.

The CVSS score of 5.9 reflects moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild. The plugin is not included in the CISA KEV catalog. The attack vector is user‑controlled input that is reflected into the page’s DOM, meaning an attacker must supply malicious data that the plugin outputs. While the potential impact is limited to client‑side code execution, the current likelihood of real‑world exploitation is low.