The vulnerability is a classic web‑based Cross Site Scripting flaw that allows an attacker to inject arbitrary JavaScript into the subscriber interface of the WC Fields Factory plugin. When executed, the injected script runs in the context of any user who views the page, potentially allowing the hijacking of session cookies, defacement of the website, or the delivery of further malicious payloads. The weakness is a classic input validation failure classified as CWE‑79.

The affected product is WC Fields Factory for WordPress, developed by Saravana Kumar K. Versions up to and including 4.1.12 are impacted. Any WordPress site running this plugin version and exposing the subscriber form is vulnerable.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of 0.00211 suggests a low probability of exploitation and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently widely exploited. The likelihood of exploitation depends on the plugin’s exposure; any site allowing public subscriber submissions could be vulnerable. A typical attack would involve an attacker crafting a malicious payload that is submitted through the subscriber form, leading to cross‑site script execution for visitors to the affected pages.