The vulnerability is a cross‑site request forgery that permits an attacker to inject and store malicious script code within a user profile field. When a legitimate user proceeds through a forged request, the plugin accepts the input and stores it, resulting in a stored XSS condition that triggers whenever the profile is viewed. The stored payload runs in the context of the site, allowing tampering with data, defacement, or cookie theft. This weakness is classified as CWE‑352.

The affected product is the Scriptonite Simple User Profile WordPress plugin, versions from the earliest available release through version 1.9. Any site operating that plugin version is susceptible.

With a CVSS score of 7.1, the vulnerability carries high severity. The EPSS score of less than 1% indicates that, at the time of analysis, the likelihood of exploitation is low but not negligible. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be CSRF, meaning an attacker must persuade a legitimate user to submit a forged request; once the malicious content is stored, the script will execute for all users who view the affected profile. Unless mitigated, an adversary could achieve persistent cross‑site script execution across the site.