The vulnerability allows an attacker to inject arbitrary JavaScript into pages that the target user visits. Because the plugin outputs data based on the PHP_SELF variable without proper escaping, a malicious URL can contain user‑controlled script code that the browser will execute when the page is rendered. This can lead to defacement, credential theft, or further exploitation of the victim's browser context.

WordPress sites running the NS Product icon badge plugin version 1.2.4 or earlier are affected. The plugin is distributed by nsthemes under the product name NS Product icon badge.

The CVSS score of 6.1 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. The likely attack vector is via a crafted link or form that includes unsanitized PHP_SELF data; unauthenticated users can trigger the exploitation by visiting the link. An attacker with no credentials can therefore inject scripts that will execute in the context of any user who views the impacted page.