The vulnerability is a DOM‑based Cross‑Site Scripting flaw caused by improper neutralization of user input during web page generation. An attacker can insert malicious JavaScript that runs in the browser of anyone who views the affected page. Depending on the site configuration, this could allow credential theft, session hijack, or defacement of the site.

The flaw affects the VeronaLabs WP Statistics plugin for WordPress installations, version 14.16.6 or older. Any WordPress site that has this plugin installed and not updated to at least 14.16.7 is potentially exposed.

The CVSS score of 7.1 rates the vulnerability as high. EPSS is not available, and the flaw is not listed in CISA KEV, indicating no widely known exploits. The typical attack vector for DOM‑based XSS is to craft a special URL or input that is reflected in the page, so a normal site visitor who follows a malicious link could be impacted. While no active exploits are reported, the potential for client‑side compromise makes this a significant risk, especially for sites with high traffic.