Improper neutralization of input during web page generation allows a DOM‑based XSS vulnerability in the RealMag777 WPCS currency‑switcher plugin. Based on the description, it is inferred that an attacker can inject arbitrary JavaScript through unfiltered user input such as URL parameters or form data, which then executes in the victim’s browser. This can compromise the confidentiality, integrity, or availability of user sessions by enabling cookie theft, session hijacking, or site defacement.

The vulnerability affects the WordPress WPCS currency‑switcher plugin from earliest known versions up to and including 1.3.1. All WordPress sites that have not updated this plugin beyond 1.3.1 are potentially exposed.

The CVSS score of 7.1 classifies the issue as high severity. Although no EPSS score is provided and the vulnerability is not listed in the CISA KEV catalog, it is inferred that exploitation may require only a crafted URL or form submission by a malicious actor. If an attacker succeeds, the impact could range from mild defacement to full session compromise for each visitor who follows the malicious link.