The vulnerability allows a subscriber to inject malicious script code into the Profile Builder plugin’s output, resulting in a cross-site scripting flaw. An attacker could embed JavaScript that executes in the browsers of other users who view the affected profile page or receive the data, potentially stealing cookies, credentials, or defacing the site. The weakness is a classic input validation flaw captured by CWE‑79.

The flaw affects the Cozmoslabs Profile Builder plugin for WordPress, versions 4.0.2 and earlier. Sites running these versions or any older revision of the plugin are vulnerable.

The CVSS score of 6.5 indicates a moderate severity, and there is no EPSS data or KEV listing, so the likelihood of exploitation is unknown but feasible. Based on the description, it is inferred that the attack would most likely be carried out from a web interface where the vulnerable plugin presents user‑submitted data; an attacker only needs to create or edit a profile with malicious payloads. Successful exploitation leads to client‑side code execution in the context of the website, allowing session hijacking, credential theft, or defacement.