The vulnerability is a stored Cross‑Site Scripting flaw in the WordPress plugin User Avatar – Reloaded by Saad Iqbal. An attacker can inject malicious scripts that will execute in the browsers of any user who views a page containing the compromised avatar. This allows attackers to steal session cookies, perform identity theft, deface content or conduct further attacks. The weakness is classified as CWE‑79, improper neutralization of input during web page generation.

The plugin User Avatar – Reloaded version 1.2.2 or earlier is affected. This includes any WordPress installation that has the plugin installed and active. The vulnerability spans all WordPress sites using this plugin regardless of PHP or WordPress version, since the issue resides in the plugin code.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than one percent shows a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a stored XSS through the avatar upload interface, which requires write access to the avatar data store – typically granted to logged‑in users or administrators. If an attacker can create or modify an avatar, the injected script will run for all visitors who load that avatar.