An unauthenticated Cross Site Scripting flaw exists in WP User Frontend Pro versions up to 4.2.13. The vulnerability allows an attacker to inject arbitrary JavaScript that is rendered in the browser of any user who views affected content. Because no authentication is required, the flaw can be exploited by anyone visiting the site, enabling phishing, cookie theft, or defacement. The weakness is a classic input‑validation error (CWE‑79).

The vulnerable software is the weDevs WP User Frontend Pro plugin for WordPress, specifically versions 4.2.13 and earlier. Sites that have installed these plugin releases with the plugin’s form or front‑end input fields exposed are susceptible.

The CVSS score of 7.1 indicates a high severity. The EPSS score is < 1%, indicating a very low exploitation probability. The lack of a KEV listing does not diminish the potential risk. The likely attack vector is via the plugin’s input fields; because authentication is not required, any visitor to a page that processes the plugin data can deliver malicious script. Successful exploitation results in the execution of attacker‑supplied code within the victim’s browser session, compromising confidentiality, integrity, and availability of the user’s data and site content.