The vulnerability arises from improper neutralization of input during web page generation in the WordPress User Extra Fields plugin. Reflected cross‑site scripting allows an attacker to inject JavaScript that runs in the browser of any user who views a page containing the unescaped input. Though no escalation is documented, XSS can lead to cookie theft, session hijacking, defacement, or redirection to malicious sites, impacting the confidentiality, integrity, and availability of the affected WordPress installation.

The vulnerability affects the vanquish User Extra Fields plugin for WordPress in all releases from the initial version through 16.8, inclusive. Any WordPress site that has installed or loaded an affected version of the plugin is potentially vulnerable. The recommendation is to update the plugin to any version higher than 16.8 or to remove the plugin entirely if no upgrade path exists.

The CVSS score of 7.1 indicates a high risk severity. The EPSS score of less than 1% shows that the probability of exploitation in the wild is low at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is reflected XSS triggered by manipulating user input that the plugin fails to sanitize before output. Even with low exploitability, the potential impact of successful injection motivates prompt remediation.