This vulnerability is an Improper Neutralization of Input During Web Page Generation (XSS) flaw that allows attackers to inject malicious JavaScript into web pages rendered by the WP eMember theme. The software fails to properly escape user controlled data, enabling reflected XSS. When an attacker supplies crafted input (for example through URL parameters, form fields, or other input vectors), the malicious script is executed in the victim’s browser with the privileges of the site’s users, potentially leading to session hijacking, phishing, or defacement.

The WP eMember theme from Tips and Tricks HQ is affected in all releases up to and including version 10.2.2. Any WordPress installation using a version labeled 10.2.2 or earlier is vulnerable. Versions newer than 10.2.2 are not impacted according to the available information.

The CVSS score of 7.1 indicates a high severity of this reflected XSS. Exploitation requires that an attacker can influence input that is reflected in a response, likely via crafted URLs or inputs on the front‑end. No EPSS score is reported, and the vulnerability is not listed in the KEV catalog, suggesting it is not a widely known exploit yet. However the high severity and the ease of exploiting reflected XSS make this a significant risk for any exposed users. The attack vector is assumed to be remote through a web request that carries the malicious input, as is typical for reflected XSS scenarios.