This flaw is an Improper Neutralization of Input During Web Page Generation (XSS) vulnerability affecting the Tips and Tricks HQ WP eMember theme. The lack of input sanitization allows reflected cross‑site scripting in responses rendered by the theme, permitting attackers to inject malicious JavaScript. By supplying crafted input – for example via URL parameters or form fields – the script is executed in the victim’s browser with the permissions of the site’s user, which can lead to session hijacking, phishing, or defacement.

The WP eMember theme from Tips and Tricks HQ is affected in all releases up to and including version 10.2.2. Any WordPress installation using a version labeled 10.2.2 or earlier is vulnerable. Versions newer than 10.2.2 are not impacted according to the available information.

The CVSS score of 7.1 indicates a high severity of this reflected XSS. Exploitation requires that an attacker can influence input that is reflected in a response, likely via crafted URLs or inputs on the front-end. The EPSS score is < 1%, indicating a very low but non-zero probability of exploitation, and the vulnerability is not listed in the KEV catalog, suggesting it is not a widely known exploit yet. However the high severity and the ease of exploiting reflected XSS make this a significant risk for any exposed users. The attack vector is assumed to be remote through a web request that carries the malicious input, as is typical for reflected XSS scenarios.