This vulnerability is an Improper Neutralization of Script-Related HTML Tags flaw that allows malicious code to be injected into web pages served by the WordPress Frontend File Manager plugin. An attacker could embed JavaScript or other executable content into files or inputs handled by the plugin, potentially leading to defacement, credential theft, or further exploitation depending on the user’s privileges. The flaw is classified as CWE-80, a Basic Cross‑Site Scripting weakness that directly impacts confidentiality, integrity, and availability of the web application for affected users.

The vulnerability affects the N‑Media Frontend File Manager WordPress plugin (nmedia‑user‑file‑uploader) in all released versions up to and including 23.6. No specific version subrange is identified beyond the upper bound of 23.6.

The CVSS score of 4.6 indicates a moderate impact level, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a user providing unsanitized input—such as uploading a file or adding content—that contains script tags. An attacker would need to exploit this input path to render the injected code in a browser context, which may require that the target user has a browser session with the site. The risk is considered moderate but not critical.