The Terms descriptions plugin for WordPress contains an improper neutralization of user input during web page generation, allowing attackers to inject malicious JavaScript via the plugin’s description field. This DOM‑based XSS flaw can lead to the execution of arbitrary client‑side scripts in the context of the site’s visitors, potentially compromising user sessions, defacing pages, or redirecting users to malicious sites. The weakness is classified as CWE‑79.

This vulnerability affects installations of the Vladimir Statsenko Terms descriptions plugin for WordPress with any version up to and including 3.4.9. All WordPress sites that have deployed this plugin within the affected version range are at risk.

The CVSS score of 5.9 indicates a moderate severity and the EPSS score of less than 1 % suggests a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Likely attack vectors include a crafted link or a manipulated description field that, when rendered by a visitor’s browser, will execute the injected script. Because the vulnerability is client‑side and does not require authentication, any user who visits a page that includes an affected description can be impacted.