This vulnerability is an improper neutralization of user input during page generation, which results in a reflected XSS flaw. An attacker can embed malicious script into a crafted URL or form input that the plugin then displays on the page. If a victim clicks the link or processes the input, the script runs in the browser under the victim's privileges, potentially leaking session cookies, defacing content, or hijacking the session.

Affected is the WordPress plugin Custom Users Order by Hiren Patel, version numbers from unknown up to and including 4.2 inclusive.

The base CVSS score of 7.1 indicates high severity. The EPSS is below 1%, so widespread exploitation is unlikely yet the flaw can lie dormant. Attackers can likely exploit the vulnerability remotely by sending a crafted request; no authentication is required and any user who visits the affected content may be impacted. It is not listed in the CISA KEV catalog but remains publicly disclosed.