The WP Front User Submit / Front Editor plugin suffers from an improper neutralization of input during web page generation. Unsanitized data supplied through the plugin’s front‑end interfaces is reflected back in the browser, allowing attackers to inject malicious scripts. The exploitation can lead to script execution in the victim’s context, facilitating session hijacking, cookie theft, defacement, or redirection to phishing sites. The weakness is a classic DOM‑based or reflected XSS described by CWE‑79.

This flaw affects the WordPress plugin WP Front User Submit / Front Editor, version 4.9.3 and earlier, distributed by aharonyan. WordPress sites that have installed any of these versions without earlier hardening are vulnerable.

The CVSS score of 7.1 indicates high severity. The EPSS score is below 1 %, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to craft a URL or form input that is processed and displayed by the plugin, so the primary vector is the front‑end user interface. Given the high impact of XSS and the availability of a fix, the risk remains significant until a patch is applied.