An attacker can craft a URL containing malicious JavaScript that is reflected into the page HTML without proper neutralization. This satisfies the CWE‑79 weakness, allowing arbitrary script execution within the victim’s browser. The result is client‑side compromise such as session hijacking, defacement, or credential theft, which jeopardizes the confidentiality and integrity of user interactions on the affected WordPress site.

The vulnerability exists in the Metagauss ProfileGrid WordPress plugin, versions from the earliest release through 5.9.5.7. Sites that have not upgraded past 5.9.5.7 and that have the plugin active are at risk.

The CVSS score of 7.1 indicates high severity. The EPSS score of less than 1% suggests exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to entice a user to visit a crafted URL or load a page that includes the vulnerable parameter, which is typical for reflected XSS attacks.