The vulnerability is a stored cross‑site scripting flaw that occurs when user input is not properly neutralized before display. Attackers could inject malicious scripts that are executed in the browsers of all visitors to the affected WordPress site. This could result in theft of session cookies, defacement, or further client‑side attacks.

Any WordPress installation that has the Metagauss ProfileGrid plugin version 5.9.8.1 or older is affected. The plugin allows community and user profile management, and the flaw exists in all versions up to and including 5.9.8.1.

The CVSS base score is 6.5, indicating moderate risk. No EPSS score is currently reported, and the vulnerability is not on CISA’s KEV list. Exploitation requires finding an input vector within the plugin’s UI; once injected, the payload is stored and served to all users, so an attacker only needs to persuade a user to act or exploit a secondary vector to inject data. Remediation is best handled through an immediate update.