Improper neutralization of user input during page generation creates a DOM‑based Cross‑Site Scripting weakness. An attacker can inject malicious JavaScript that runs in the browsers of visitors to affected pages, potentially compromising session data, defacing the site, or executing further attacks in the victim’s context. The vulnerability is classified as CWE‑79.

WordPress sites that have installed Mark O’Donnell’s MSTW League Manager plugin in any version up to and including 2.10 are affected. All releases preceding 2.11 contain the flaw and remain vulnerable until patched.

The CVSS v3.1 base score of 6.5 signals moderate severity. EPSS data is unavailable and the flaw is not listed in the CISA KEV catalog, indicating no confirmed large‑scale exploitation to date. Based on the description, the likely attack vector is an unauthenticated visitor triggering the flaw via a crafted URL or malicious content that causes the vulnerable code to evaluate user input in the browser; no special privileges or authentication are required.