The vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject malicious JavaScript into the plugin’s output. Once injected, the script runs in any user’s browser who views the affected page, potentially stealing session cookies, defacing content, or redirecting users to phishing sites. The weakness is classified as CWE‑79, indicating improper neutralization of user input during web page generation.

The issue affects the WordPress Frontend Dashboard plugin created by M A Vinoth Kumar. All releases from the earliest available version up through 2.2.8 are impacted; any installation running a version at or below 2.2.8 is vulnerable, regardless of the exact minor version.

The CVSS score of 6.5 reflects a medium severity, and the EPSS score of less than 1% indicates that the likelihood of public exploitation is currently low, with no listing in the CISA KEV catalog. Exploitation requires the ability to submit data to the plugin’s front‑end form; the stored payload is later rendered in the page view for all users. The attack vector is inferred to be the plugin’s web interface, potentially accessible to any authenticated or unauthenticated user depending on the site's configuration.