The vulnerability arises from the plugin's failure to neutralize user input before including it in rendered web pages, allowing attackers to store malicious scripts that execute when a page is viewed. The stored XSS flaw can compromise user accounts that visit affected pages, potentially leading to session hijacking or the delivery of malware. Based on the CWEs listed, the weakness is an improper input validation flaw that can occur in modern web applications that render data from untrusted sources.

The affected product is the WordPress plugin "Frontend Admin" by DynamiApps, version 3.30.1 and all earlier releases (including those of unspecified prior versions). Users deploying the plugin on their WordPress sites are susceptible to the flaw until the vendor releases a fixed version.

The CVSS score of 7.1 indicates a significant risk that could be exploited by attackers. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the lack of a KEV listing means that no known exploitation campaigns have yet targeted this weakness. The attack vector is likely through user input that the plugin stores and later displays on the front end without proper encoding. An attacker would need to submit crafted data, which could then be triggered when any site visitor loads a page containing that data.