Improper input neutralization in Ren Ventura WP Delete User Accounts results in stored XSS, allowing an attacker to embed malicious JavaScript that will run in the browsers of any user who views affected content. The injected script can be used to steal credentials, deface the site, or redirect visitors, thereby compromising user confidentiality and integrity. The weakness is a classic Stored XSS, classified as CWE‑79.

The vulnerability affects the WP Delete User Accounts plugin published by Ren Ventura. All releases up to and including version 1.2.4 are impacted; newer versions are presumed to contain the fix.

The assigned CVSS score of 6.5 indicates medium severity, while an EPSS score of less than 1% suggests a very low likelihood of exploitation at the time of this analysis. The issue is not listed in the CISA KEV catalog. Attackers would likely need access to the plugin’s configuration interface or a means to inject data that is stored and later rendered on the site, so authentication or privileged access is a probable requirement.