An improper neutralization of user input occurs during web page generation in RealMag777 MDTF, allowing a DOM‑based Cross‑Site Scripting (XSS) flaw. The vulnerability can be triggered by inserting malicious data that the plugin does not sanitize, which then becomes part of the client‑side script context. As a result, an attacker may inject script code that runs in the victim’s browser, potentially stealing session data, defacing content, or redirecting users to malicious sites. The weakness is defined as CWE‑79.

The affected product is the WordPress MDTF plugin (wp‑meta‑data‑filter‑and‑taxonomy‑filter) from RealMag777. Versions from the initial release up through 1.3.5 are susceptible. Any WordPress site that has this plugin installed and has not upgraded past 1.3.5 is at risk.

The CVSS score is 6.5, indicating a medium severity. EPSS is below 1%, suggesting exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the user to load a page that utilizes the vulnerable plugin, and likely involves manipulation of query parameters or form input that is rendered unescaped. The attack vector is inferred to be client‑side via the user’s browser, as the flaw is DOM‑based; however, the description does not explicitly state the exact method.