The "User Registration Aide" WordPress plugin contains a reflected cross‑site scripting vulnerability in its user registration flow. An unauthenticated attacker can supply malicious script content that is reflected in the generated page, allowing the execution of arbitrary code in the victim’s browser. This could lead to session hijacking, credential theft, or defacement, as described by CWE‑79.

The vulnerability affects the Bnovotny User Registration Aide plugin for WordPress, versions from the initial release up through 1.5.3.8.

The CVSS score of 7.1 indicates moderate severity; the EPSS score is below 1%, suggesting low likelihood of widespread exploitation, and the issue is not listed in CISA's KEV catalog. Exploitation requires the attacker to craft a malicious URL or form input that is reflected back into the page, typically via the plugin’s registration interface, making the attack possible from any visitor to the affected site. Given the low EPSS, the risk remains moderate but still significant for exposed WordPress installations.