The vulnerability is a DOM-based Cross‑Site Scripting flaw in the Korea SNS WordPress plugin. An attacker can craft a malicious URL or input that, when processed by the plugin in a victim’s browser, injects arbitrary JavaScript. This can lead to theft of user session data, cookie hijacking, or the addition of malicious content to rendered pages, compromising the confidentiality and integrity of user data processed by the plugin.

The affected product is the Korea SNS WordPress plugin, version 1.7.0 and earlier. Any WordPress site that has installed this plugin without updating to a newer release is at risk.

With a CVSS base score of 5.9, the vulnerability presents moderate risk, and its EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The flaw is client‑side and requires that a victim visit a page rendered by the plugin; it does not affect server‑side processing or other users directly. The vulnerability is not listed in the CISA KEV catalog, suggesting no known or publicly exploited instances yet.