The UDesign Core plugin contains an improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that are executed in users’ browsers. This flaw is identified in CWE‑79 and can lead to theft of session cookies, defacement, or the transmission of additional payloads to third parties.

WordPress sites running AndonDesign UDesign Core plugin versions up to 4.14.1 are susceptible. No specific sub‑versions are listed, so all releases prior to 4.15.0 are presumed affected.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% reflects a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack path is through a web request that reaches an input‑handled endpoint of the plugin, where malicious payloads are rendered without proper escaping; attackers do not need specialized credentials but could target any user who visits a compromised page.