Improper neutralization of input during web page generation in Ultimate Dashboard Pro creates a DOM‑based cross‑site scripting flaw. The plugin receives user‑controlled data and outputs it without sufficient sanitization, allowing an attacker to embed arbitrary JavaScript into webpages that load the plugin. When a user visits a crafted URL or interacts with affected dashboard elements, the injected script can run in the context of the site, enabling session hijacking, defacement, or redirection to malicious sites. This is a classic input validation failure classified as CWE‑79.

The affected product is Ultimate Dashboard Pro plugin for WordPress, versions up to and including 3.11.2. Any WordPress installation that has this plugin installed and not upgraded to a newer release is vulnerable.

The CVSS score of 7.1 indicates a moderate‑to‑high severity. The EPSS score of < 1% indicates a very low but non‑zero probability of exploitation, although the flaw is unauthenticated, meaning that an attacker only needs to craft a malicious payload and deliver it through the plugin’s input vectors. The lack of a KEV listing suggests that while there may be no confirmed public exploits, the exposure remains significant, especially for high‑traffic sites or those using the plugin’s public contact forms or dashboards.