Improper neutralization of user input during page generation in the Blog Filter plugin permits a DOM‑based cross‑site scripting attack. This type of vulnerability (CWE‑79) allows an attacker to inject and execute arbitrary JavaScript in the context of a victim’s browser, which can lead to session hijacking, defacement, or the insertion of malicious content. The vulnerability exists because the plugin fails to sanitize or encode input before it is used in the generated web page. The potential impact is confined to the web application’s client‑side code and can affect all users who visit pages affected by the plugin.

The vulnerability affects the A WP Life Blog Filter product, known by its vendor name A WP Life: Blog Filter. Versions from the initial release up to and including 1.7.6 are impacted. No other specific version ranges are given, and the plugin is publicly available on WordPress.org.

The CVSS score for this vulnerability is 6.5, indicating moderate severity, and the EPSS score is below 1%, suggesting a low likelihood of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be client‑side, requiring an attacker to supply malicious input through the plugin’s interface or exposed parameters. Because the flaw is DOM‑based, it can be triggered by loading a crafted URL or by submitting untrusted data via the plugin’s filtering mechanism. The impact is limited to users who interact with pages rendered by the affected plugin and does not grant the attacker direct server‑side control.