The vulnerability resides in the WP Customer Area WordPress plugin and allows attackers to persist a malicious script by setting the display_name field. When the script is rendered on any page that shows this name, it executes in the victim’s browser, potentially leading to defacement, credential theft, or further session hijacking. This fits the CWE‑79 classification of Cross‑Site Scripting and directly compromises user interaction integrity.

The affected product is the WP Customer Area plugin for WordPress, version 8.4.0 and all earlier releases. No other plugins or core WordPress components are listed as impacted.

The CVSS score of 6.4 indicates moderate severity. Because the exploit requires only authenticated access at the subscriber level, the risk is elevated in environments where such accounts exist and the plugin controls are insufficient. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the lack of availability does not reduce the likelihood that an attacker may discover and exploit this flaw. The attack vector is inferred to be through the user profile editing interface where the display_name field is unsanitized, allowing an attacker to embed a script that will run in the context of any user who accesses the same page.