This vulnerability allows an attacker to inject malicious script or HTML content into pages rendered by the ProfilePress plugin. The improper neutralization of script‑related tags permits code injection that will run in the context of visitors accessing the affected WordPress site, enabling session hijacking, cross‑site scripting attacks, or defacement. The weakness is a basic XSS flaw (CWE‑80) and does not provide immediate remote code execution, but can be used for stealthy persistence or data exfiltration.

The issue affects the properfraction ProfilePress WordPress plugin version 4.17.7 and earlier releases. The plugin is widely used for managing user profiles and avatar uploads on WordPress sites.

The CVSS score of 4.3 indicates a low‑to‑moderate severity, and no EPSS score is available. The vulnerability is not listed in the KEV catalog. Because the flaw exists in a publicly accessible plugin, any visitor who can submit or edit profile content can exploit it, making the attack vector local to the web interface. An attacker would not require privileged credentials to inject code, leading to a relatively high likelihood of exploitation under the right circumstances.