The vulnerability is a stored XSS flaw arising from improper neutralization of user input during web page rendering in the Rustaurius Front End Users plugin. An attacker who can inject malicious data into the plugin’s data store can have that input displayed as an active script to any user who views the affected page. Because the payload is stored, the compromise can affect all users who access the vulnerable page, potentially allowing cookie theft, session hijacking, or defacement of the site.

The flaw affects the WordPress plugin "Front End Users" (Rustaurius) for all installed versions up to and including 3.2.35. The plugin is commonly used to manage front‑end user access on WordPress sites.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score displays a very low likelihood of exploitation in the wild (<1%). The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by creating or modifying content via the plugin’s front‑end interface, which stores the malicious script and later injects it into the generated HTML. The exploit requires that the vulnerable plugin is installed and a page that renders the stored input is accessed by a user with browser execution capability.