The Supreme Modules Lite plugin contains a Cross Site Scripting vulnerability in all releases up to version 2.5.63. The flaw allows an unauthenticated attacker to inject malicious script into the HTML output of a WordPress site. A successful exploitation can compromise the confidentiality, integrity, and availability of the site and its users, enabling phishing, data theft, or defacement. This defect is classified as CWE‑79.

Targeted systems are WordPress installations that have the Supreme Modules Lite plugin installed, with affected versions being all releases up to 2.5.63. The plugin is distributed under the vendor name Supreme Modules and is listed as Supreme Modules Lite in public advisories.

The CVSS score of 5.9 indicates a moderate severity, while no EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited. The likely attack vector is via a web request to the vulnerable plugin endpoint, which may be reached by any user with site accessibility. The risk therefore depends on site exposure and user interaction, but should be addressed promptly.