The falldeaf WP ViewSTL plugin suffers from a DOM-based cross-site scripting vulnerability caused by improper input neutralization during web page generation. This allows an attacker with low privileges and requiring user interaction to execute arbitrary scripts in the context of the affected web application. The issue affects all versions up to 1.0 of WP ViewSTL. The CVSS score is 6.5, indicating a medium severity level. No known exploits are reported in the wild, and no patch or vendor advisory has been provided yet.

Successful exploitation of this vulnerability could lead to partial compromise of confidentiality, integrity, and availability of the affected system. Because it is a DOM-based XSS, it may allow execution of malicious scripts in users' browsers, potentially leading to session hijacking or other client-side impacts. However, exploitation requires user interaction and low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, consider restricting access to the plugin or disabling it until a patch is available. Avoid clicking on untrusted links that could trigger the vulnerability.