The flaw resides in the handling of filter parameters such as 'filter_first_name' in the Ultimate Member plugin for WordPress; user input is not properly escaped when rendered in page responses. An attacker can craft a link that includes malicious script payloads, which will be executed in the victim's browser when the link is followed, enabling cookie theft, session hijacking, or site defacement. The vulnerability is a classic reflected XSS and is executed in the context of any authenticated or unauthenticated visitor who follows the malicious URL.

WordPress sites that use the Ultimate Member plugin in any release up to and including version 2.11.1 are affected. The issue impacts the plugin’s filter functionality accessible through public URLs, allowing attackers to inject payloads via query string parameters.

The CVSS score of 6.1 classifies the vulnerability as moderate; the EPSS score of less than 1% indicates a low probability of exploitation at this time, and the vulnerability is not presently tracked in the CISA KEV catalog. Exploitation requires an unauthenticated attacker to entice a victim to click a specially crafted link containing malicious script in a filter parameter – a social engineering vector that is feasible but not trivial. Because the attack does not require privileged access or pre-existing credentials, the potential impact on confidentiality, integrity, and availability remains significant if an attacker succeeds.