The UiPress lite plugin is vulnerable because the uip_save_ui_template function lacks a capability check in all.5.09. As a result, any authenticated user with Subscriber-level access can create or modify a template that contains arbitrary JavaScript. When a site visitor or administrator opens the page that renders the template, the injected code is executed in the visitor’s deface the site, steal session cookies, track users, or otherwise compromise the integrity and confidentiality of the WordPress installation.

This flaw exists in the admintwentytwenty:UiPress lite plugin up to version 3.5.09 and all earlier releases. The vulnerability is confined to the WordPress plugin plugin enabled and allow non‑administrator users to edit or create UI templates. Any WordPress site that has not upgraded beyond template editing rights to subscribers or higher is potentially impacted.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of < 1% points to a low probability of exploitation at present. However, because the flaw permits stored cross‑site scripting, the impact could be severe if an attacker succeeds. The vulnerability is not cataloged in CISA’s KEV database, and no other public exploits have been reported. Attackers must be authenticated, but the minimum required privilege level is only Subscriber, which is granted to many users on a typical WordPress site. Once the malicious template is saved, any visitor to the affected page will run the injected code, making the risk both wide and immediate for users who view the crafted content.