The Codstack wp_automatic_widget plugin versions up to 1.0.1 contain a DOM-based Cross-site Scripting vulnerability caused by improper neutralization of input during web page generation. This allows an attacker with low privileges and requiring user interaction to execute malicious scripts in the context of the affected web application, potentially impacting confidentiality, integrity, and availability.

Successful exploitation can lead to partial compromise of confidentiality, integrity, and availability of the affected system due to DOM-based XSS. The attacker could execute arbitrary scripts in the victim's browser, potentially leading to session hijacking or other client-side attacks. However, exploitation requires user interaction and low privilege access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the wp_automatic_widget plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.