Malicious users can inject arbitrary JavaScript through the subscriber profile fields of the WordPress Profile Extra Fields by BestWebSoft plugin. When a profile field is submitted or updated, the plugin fails to escape the input, allowing embedded script code to execute in the visitor's browser. This client‑side code execution can be leveraged to hijack sessions, steal credentials, deface the site or redirect users to phishing pages. The flaw is a classic input‑validation weakness aligned with CWE‑79.

This vulnerability impacts the WordPress plugin Profile Extra Fields by BestWebSoft, versions 1.3.4 and older, used to manage extended profile fields on WordPress sites.

Based on the description, it is inferred that attackers would need the ability to submit or edit profile data, a capability typically available to any authenticated site user. The plugin fails to escape input, enabling the injection of malicious JavaScript into subscriber profile fields. This client‑side code execution can be used to hijack sessions, steal credentials, deface the site or redirect users to phishing pages. The CVSS score of 6.5 indicates moderate severity, while no EPSS score is reported so the current likelihood of exploitation is unknown. The vulnerability is not listed in CISA’s KEV catalog, suggesting no large‑scale exploitation at the time of this assessment.