This flaw in the Front End PM plugin allows a subscriber to embed arbitrary script code within the plugin’s interface. The injected code could execute in a visitor’s browser, enabling defacement, credential theft, or session hijacking. The vulnerability is a classic example of unsanitized user input leading to arbitrary script execution, corresponding to CWE‑79.

WordPress sites using the Front End PM plugin version 11.4.6 or earlier, developed by Shamim Hasan.

The moderate CVSS score of 6.5 suggests that the vulnerability requires the attacker to be an authenticated subscriber, though this is inferred from the described context rather than explicitly stated, and grants significant impact on the target site. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is likely through the plugin’s subscriber‑level endpoints and does not require additional system’s functionality.