The Advanced IP Blocker plugin for WordPress contains an improper neutralization of input during web page generation that enables DOM‑based XSS. Malicious JavaScript injected through unescaped user input runs in the victim’s browser, potentially stealing session cookies, hijacking accounts, defacing the site, or installing client‑side malware. This weakness is a classic CWE‑79 type of vulnerability.

The vulnerability affects the IniLerm Advanced IP Blocker plugin, version 8.10.7 and any earlier releases that have not yet been patched. Administrators of WordPress sites that have not upgraded past 8.10.7 are at risk.

The CVSS score of 7.1 indicates a high impact rating; the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, as the attacker can embed malicious payloads via crafted URLs or form submissions that the plugin fails to sanitize. If an attacker can lure a user to a page containing the vulnerable input, they can execute arbitrary code in the user’s browser. While no active exploits are documented on KEV, the combination of high CVSS and remote operation warrants immediate attention.