The WP User Manager plugin accepts a user‑supplied "display_name" through the REST endpoint and stores it without proper sanitization. The value is subsequently rendered on public profile pages, allowing an authenticated attacker with subscriber‑level access and above to embed malicious JavaScript that runs in the browsers of any user who views the affected page.

WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin for WordPress, affected in all versions up to and including 2.10.2.

The vulnerability has a CVSS score of 6.4, indicating moderate severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Attack requires an authenticated user with at least subscriber privileges. The exploit path involves sending a crafted request to POST /wp-json/wp/v2/users/me with a malicious "display_name", thereby injecting script that runs on profile displays. Given its moderate score and requirement for user authentication, the risk is significant for sites with broad subscriber populations.