An unauthenticated reflected XSS vulnerability exists in WordPress Paid Member Subscriptions plugins up to 2.17.3. Unsanitized input from URLs or form fields is returned in the page without proper output encoding, allowing an attacker to inject arbitrary scripts that execute in the browser of any user who visits the crafted page. This can lead to theft of session cookies, credential hijacking, defacement, or execution of additional malware, thereby compromising the confidentiality and integrity of user data and the trustworthiness of the site.

The vulnerability affects the Cozmoslabs Paid Member Subscriptions plugin for WordPress on versions 2.17.3 and earlier. Any WordPress installation using this plugin in its affected releases is at risk, regardless of user privileges.

With a CVSS score of 7.1 the vulnerability is classified as moderate to high severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and it is not listedV catalog. Nonetheless, because the attack vector is unauthenticated and relies on a malicious URL or form submission, a determined attacker can exploit it from any network without prior access, making it a credible threat to sites that have not yet updated the plugin.