The Vulnerable plugin allows an authenticated subscriber or higher to store malicious script code in the readonly user field that is rendered via the [pmpro_member_profile_edit] shortcode. The lack of proper input sanitization and output escaping means the stored script will run in a visitor’s browser when the associated page is viewed, allowing the attacker to execute arbitrary client‑side code, potentially steal session data or deface content.

WordPress sites running the Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin, versions up to and including 3.8.1.

The CVSS score of 6.4 indicates a medium severity vulnerability. The EPSS score is less than 1 %, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with subscriber-level access or higher, but no known public exploitation has been reported. The likely attack path involves an attacker logging into the site, editing the readonly user field via the shortcode, and embedding malicious JavaScript that will execute for any visitor of the resulting page.