The vulnerability is a Cross Site Scripting (XSS) flaw that exists in all versions of the WordPress ProfilePress plugin up to and including 4.16.13. This weakness allows an attacker to inject malicious scripts into certain components of the plugin’s output. The injected scripts are then executed in the browser of any user who views the affected page, potentially allowing code execution within the user’s context.

The affected product is the WordPress ProfilePress plugin provided by properfraction. All installations running version 4.16.13 or earlier are impacted.

The CVSS score of 6.5 places the issue in the medium severity range and the EPSS score of less than 1% indicates a low probability of exploitation currently. The vulnerability is not listed in CISA’s KEV catalog. While the CVE does not specify detailed exploitation steps or required user interaction, the nature of XSS implies that an attacker would need to embed malicious input that is processed and rendered by the plugin. The potential impact is limited to client‑side code execution but could lead to broader compromises if the attacker is able to target sensitive users or execute persistent attacks.