The vulnerability allows unauthenticated attackers to inject arbitrary scripts through the 's' parameter in various plugin pages. This reflected cross‑site scripting flaw results in the execution of malicious JavaScript in a victim’s browser when the victim follows a crafted URL or link. The primary impact is the compromise of user session data, credential theft, and the ability to load further malicious content. The weakness is identified as CWE‑79, which highlights a lack of proper input sanitization and output escaping on the server side.

The affected product is the WordPress plugin "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder" by WPEverest. Versions up to and including 4.0.4 are vulnerable. Any WordPress installation using these plugin versions is at risk.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% shows a low probability of exploitation at the current moment, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an unauthenticated attacker to entice a user into clicking a malicious link; the attack vector is therefore indirect, relying on social engineering and user interaction. If successful, the attacker gains the ability to run client‑side code in the victim’s context.