The User Meta plugin for WordPress contains an improper neutralization of input during page generation that allows attackers to inject malicious scripts into the browser of any user who visits a crafted URL. This flaw is a reflected XSS, classified as CWE‑79, and can lead to session hijacking, credential theft, or malicious content injection when users interact with the affected pages.

The vulnerability affects the Khaled User Meta plugin, versions 3.1.2 and earlier. No other WordPress products are listed as affected.

The CVSS score of 7.1 indicates a moderate to high risk. However, the EPSS score of less than 1% suggests a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a malicious URL containing unsanitized input to trigger the reflected XSS, which is straightforward but requires the victim to click a link or load a tainted page.