The flaw is a stored cross‑site scripting vulnerability arising from the plugin’s failure to properly neutralise user input during page generation. An attacker who can submit a registration form can embed arbitrary JavaScript that will be stored in the database and subsequently executed whenever a site visitor loads the affected page. This can lead to credential theft, session hijacking, or delivery of phishing content. The weakness corresponds to a classic "Improper Neutralization of Input During Web Page Generation" reflected by CWE‑79.

The vulnerable component is the ThemeGrill User Registration plugin for WordPress. All installations running version 5.2.8 or earlier are affected, while versions 5.3.0 and newer contain the fix.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the public registration form; an attacker submits a malicious payload that is stored and then executed when any user visits the affected page. Because the flaw is stored XSS, the impact can reach any web‑browser user who loads the page, and exploitation can be carried out remotely via the public web interface. This assessment is inferred from the description and typical XSS exploitation patterns.