The vulnerability in Themepoints Tab Ultimate versions 1.8 and earlier allows an attacker to inject malicious script code into web pages because the plugin fails to properly neutralize user input. If an attacker succeeds, scripts can run within the context of any user accessing the site, potentially leading to credential theft, session hijacking, or defacement. The weakness is identified as CWE‑79, a classic reflected or stored XSS flaw.

All WordPress sites that have the Tab Ultimate plugin from any version up through 1.8 are affected. Site administrators must review installations to determine if the plugin is present and which version is deployed, and apply the fix before the plugin is upgraded to 1.9 or later.

The CVSS score of 6.5 indicates moderate severity; the EPSS score of less than 1% suggests low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote injection via the plugin’s input fields or URL parameters, and exploitation does not require prior authentication. While active exploitation is not widespread at present, the potential impact warrants timely remediation.