A DOM‑Based Cross‑Site Scripting flaw exists in the WordPress "List category posts" plugin (CWE‑79). The plugin fails to neutralize user input in certain page generation contexts, enabling an attacker to inject JavaScript that executes in the victim’s browser. This can result in session hijacking, defacement, or the execution of arbitrary client‑side code.

All releases of Fernando Briano’s List category posts plugin from the earliest available version up to and including version 0.93.1 are impacted, as stated in the vendor description.

The vulnerability has a CVSS score of 5.9, indicating moderate severity. EPSS shows less than a 1% chance of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. The attack vector is remote, typically via a maliciously crafted URL or link that a user clicks or visits, triggering the DOM‑based XSS. Because the impact is limited to the client’s browser, it does not compromise the server itself but can affect user confidentiality and integrity.