The vulnerability allows an attacker to inject malicious script code into the plugin’s storage, which is then rendered on the site’s user profile pages. This stored XSS can lead to cookie theft, session hijacking, or the execution of arbitrary client‑side code in the context of any user who views the affected profile. The weakness arises from improper input neutralization and is classified as CWE‑79.

The affected vendor is aviplugins.com, product WP Register Profile With Shortcode. All releases from any initial version up to and including 3.6.3 are vulnerable.

The CVSS score of 6.5 indicates a medium severity risk. The EPSS score of less than 1% suggests that exploitation is unlikely to be widespread. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely user‑generated input through the profile registration or edit form, which is stored and later displayed without proper sanitization. Successful exploitation would require access to the site’s administrative credentials or at least permission to submit profile data, making it a moderate to high risk for sites that allow open or weakly protected plugin usage.