This vulnerability in DirectoryPress arises from improper sanitization of user input during the generation of web pages, resulting in a DOM-based XSS condition. The CVSS 3.1 score of 6.5 reflects that the attack vector is network-based, requires low attack complexity, privileges, and user interaction, and impacts confidentiality, integrity, and availability to a limited extent. The issue affects all versions through 3.6.25. No patch or vendor advisory is currently provided, and no known exploits have been observed.

Successful exploitation could allow an attacker with low privileges to execute arbitrary scripts in the victim's browser, potentially leading to information disclosure, session hijacking, or other client-side impacts. The vulnerability affects confidentiality, integrity, and availability at a limited level. However, exploitation requires user interaction, which reduces the immediacy of the threat.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting privileges and educating users about the risks of interacting with untrusted content. Monitor for vendor updates regarding patches or official mitigations.