An improperly sanitized input field in Cozmoslabs Paid Member Subscriptions causes stored XSS, allowing attackers to inject JavaScript that the plugin will render on subsequent page loads. The vulnerability enables the execution of arbitrary code in the context of any user who views the affected content, potentially facilitating cookie theft, session hijacking, defacement, or the execution of further malicious payloads. The weakness is categorized as CWE‑79, reflecting a classic reflected or stored XSS flaw.

WordPress installations that use the Paid Member Subscriptions plugin version 2.14.3 or earlier are vulnerable. Any site where administrators or other privileged users have written content through this plugin is at risk until the plugin is updated.

The CVSS score of 6.5 indicates a moderate severity, while an EPSS score of less than 1% suggests a very low probability of current exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, reinforcing the low exploit likelihood. Exploitation would generally require an attacker to create or modify content within the plugin, so compromised or malicious accounts and user interaction are prerequisites. No known public exploit or active abuse has been reported as of the analysis.