The vulnerability allows a subscriber‑level or higher account to submit JavaScript through the "title" field of Webling forms or member lists. The injected code is stored and later rendered when an administrator views the affected form or list, resulting in client‑side script execution that runs with the administrator’s privileges. Such execution can lead to theft of admin session cookies, defacement, or further exploitation of the site.

WordPress sites that have the Webling plugin from usystemsgmbh installed in any version up to and including 3.9.0 are affected. No newer versions are listed as vulnerable, so sites using 3.9.1 or later are not impacted.

The CVSS score is 6.4, indicating moderate severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires an authenticated user with Subscriber or higher privileges who can edit a form or member list via the plugin’s admin interface; no special network or local access is required beyond standard web interaction with the WordPress admin area.