This vulnerability is an unauthenticated cross‑site scripting flaw that exists in the Ultimate Dashboard WordPress plugin through version 3.11.2. It allows an attacker to inject arbitrary JavaScript into the page rendering of any user who views a compromised page, potentially stealing session cookies, defacing the site, or redirecting users to malicious resources. The weakness is a classic input‑validation issue described by CWE‑79, where user data is output without proper encoding.

The affected product is the Ultimate Dashboard plugin for WordPress, version 3.11.2 or earlier. Any WordPress installation that has this plugin installed and not upgraded to a newer release is vulnerable.

The CVSS score of 7.1 indicates a moderate‑to‑high severity. While there is no EPSS value provided, the flaw is unauthenticated, meaning that an attacker only needs to craft a malicious payload and deliver it through the plugin’s input vectors. The lack of a KEV listing suggests that while there may be no confirmed public exploits, the exposure remains significant, especially for high‑traffic sites or those using the plugin’s public contact forms or dashboards.