The vulnerability is an instance of improper input neutralization during page generation, allowing Reflected XSS in the WordPress MemberSpace plugin. An attacker can craft a request that contains malicious JavaScript, which is then echoed back in the browser without proper escaping, enabling execution of arbitrary client‑side code in the context of the affected user.

WordPress installations that use the MemberSpace plugin version 2.1.13 or earlier.

The CVSS score of 7.1 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted input—typically via a URL or form parameter—that is reflected in the browser output. Because the flaw is client‑side and requires the victim to visit a malicious link, the attack vector is indirect and depends on social engineering or compromised marketing assets.