Improper neutralization of input during web page generation allows the PenciRecipe plugin (versions up to 4.1) to inject malicious JavaScript into the page content. The vulnerability is DOM‑based, meaning that an attacker can execute arbitrary scripts in the victim's browser when a specially crafted URL or input field is processed. An attacker could steal session cookies, perform account impersonation, or deface the website if the user logs in while the payload runs.

WordPress sites using the PenciDesign Penci Recipe plugin version 4.1 or earlier are affected. No other vendors or product versions are listed as affected in the current CNA data.

The CVSS score is 6.5, indicating a moderate risk. The EPSS score is below 1%, suggesting a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalogue. The likely attack vector is social‑engineering of users to visit a malicious link that triggers the DOM injection, after which the script runs under the context of the site.