This vulnerability allows stored cross‑site scripting because the plugin does not properly neutralize user input. A malicious actor can inject JavaScript that will run in the browsers of any visitor, which could be used to steal session cookies, deface pages, or hijack accounts. The flaw arises from improper handling of input during web page generation, consistent with a stored XSS weakness (CWE‑79).

The flaw affects the Cozmoslabs Paid Member Subscriptions plugin for WordPress, versions up to and including 3.1.3. Users running any of those releases on a WordPress site are at risk.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a user who can submit content through the plugin’s interface, such as creating or editing member subscription fields or stored data. If an attacker can supply input that is later rendered without proper escaping, the stored XSS can be triggered on subsequent page loads.