The vulnerability permits stored cross‑site scripting by allowing malicious input to be unsanitized and rendered in a generated web page. This flaw arises from improper neutralization of user‑supplied data during page generation and can propagate a script that executes in the context of a visitor’s browser.

The affected product is the Confirm User Registration plugin developed by Ralf Hortt, with all releases from the earliest available version through 2.1.5 vulnerable. Any deployment of a version equal to or older than 2.1.5 is impacted.

The CVSS score of 5.9 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at the current time. The vulnerability is not listed in CISA KEV. Attackers can potentially exploit the flaw by submitting malicious data in the registration process, which is then stored and later rendered to other users, allowing for payload delivery that could deface content, steal session cookies, or redirect users.