The Import and export users and customers plugin (versions up to and including 2.4.5) contains an insufficient input sanitization and output escaping flaw that allows authenticated attackers with custom‑level access or higher to store arbitrary JavaScript in custom column user meta profile fields. When a user visits a page that renders the stored data, the injected script executes in the victim’s browser. This stored XSS can be used to deface content, steal session cookies, or perform phishing attacks against other users of the WordPress site.

Affected systems are WordPress installations that have the Import and export users and customers plugin by carazo installed in any release up to version 2.4.5. Administrators should verify whether this plugin is in use and check the installed version.

With a CVSS score of 6.4 the vulnerability represents a medium risk. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread or documented exploitation is known at this time. The attack requires the attacker to be authenticated with custom‑level capability or greater, after which they can insert malicious code into the plugin’s storage. The malicious code will run in the browsers of any visitors who view pages that read the injected meta fields.