The Dominion – Domain Checker for WPBakery plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in the 'dominion_shortcodes_domain_search_6' shortcode. This vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user-supplied attributes. Authenticated attackers with contributor-level permissions or higher can exploit this to inject arbitrary JavaScript that executes in the context of users visiting the compromised pages. The vulnerability affects all versions up to 2.3.0. The CVSS 3.1 score of 6.4 reflects a medium severity with potential confidentiality and integrity impacts but no availability impact. No patch or official remediation guidance has been provided in the available data.

Successful exploitation allows an authenticated user with contributor-level access or higher to inject and store malicious scripts that execute in the browsers of users who view the infected pages. This can lead to partial confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed in the context of the victim user. There is no indication of availability impact or known exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the vulnerable shortcode if possible. Monitor for updates from the vendor or security advisories for a patch or official mitigation instructions.