Improper neutralization of input during web page generation provides a Stored XSS flaw in the WPFront User Role Editor plugin. An attacker can inject malicious scripts that execute in the context of users who view affected pages, allowing session hijacking, defacement, or credential theft. The vulnerability can compromise the confidentiality, integrity, and availability of the affected WordPress site.

The vulnerability affects the WordPress WPFront User Role Editor plugin developed by Syam Mohan. All releases from the initial build through version 4.2.3 are susceptible.

With a CVSS score of 6.5, the flaw represents a moderate risk. The EPSS score of less than 1% indicates a low probability of exploitation, and the vulnerability is not listed in CISA KEV. Attackers are likely to exploit the stored data inputs required by the plugin, and the attack vector is inferred to be local or from an authenticated user with permissions to alter role settings.