The vulnerability is a stored cross‑site scripting flaw that allows an attacker to save malicious scripts in form inputs that are later rendered in a web page. When a victim visits the page, the browser executes the script, enabling stealthy actions such as cookie theft, session hijacking, or page defacement. This attack can compromise the confidentiality and integrity of the user session and may be used in phishing‑style social engineering.

The flaw exists in the WordPress plugin WP Front User Submit / Front Editor by aharonyan and affects all releases up to and including version 5.0.6. Any WordPress installation using this plugin within that version range is vulnerable.

The CVSS score of 5.9 denotes a moderate severity overall, and the EPSS score of less than 1% indicates a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Because the script is stored via user‑supplied form fields that are publicly accessible, the most likely attack vector is an unauthenticated or low‑privilege user submitting a malicious payload through the plugin’s interface. Exploitation requires the victim to view the affected page, a common circumstance for site visitors.