An attacker can craft a URL that contains malicious JavaScript. When a victim visits that URL, the plugin does not properly neutralize the input and reflects it back in the generated page. The injected script runs in the victim’s browser, enabling actions such as cookie theft, session hijacking, defacement, or redirect to phishing sites. The flaw does not result in server‑side code execution or data disclosure but can compromise the confidentiality, integrity, and availability of user sessions when the victim interacts with the vulnerable page.

The vulnerability exists in the WP Front‑end login and register plugin developed by Mohsin Khan. Every installation of the plugin with a version number up to and including 2.1.0 is affected. The plugin is a WordPress add‑on that allows users to register and log in from the front end of a site.

The CVSS score of 7.1 places the flaw in the high severity range. The EPSS score of less than 1 percent indicates a very low probability of current exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers can execute the exploit by delivering a specially crafted URL to a target user, which generally requires user interaction (clicking the link). No authentication is required on the target site for the reflected XSS payload to run.