The vulnerability is an unauthenticated cross site scripting flaw that allows an attacker to inject arbitrary script code into web pages served by the Progressify plugin. Because the flaw is present in all unauthenticated users who load the vulnerable pages, an attacker can run malicious JavaScript in the context of the site, which can lead to theft of user credentials, session hijacking, defacement, or the delivery of further malware. The weakness is identified as CWE-79.

DaftPlug’s Progressify – Progressive Web App plugin deployed on WordPress installations, specifically versions 1.6.0 and earlier. No other vendors or products are listed as affected.

The CVSS score of 7.1 indicates a medium to high severity vulnerability. The EPSS score of <1% indicates a very low probability of exploitation, though the plugin’s widespread use may increase overall exposure. The vulnerability is not listed in the CISA KEV catalog at this time. Based on the description, the likely attack vector is via a crafted URL or content input that triggers the XSS without requiring authentication.