The CVE describes a stored Cross‑Site Scripting vulnerability in the Wedevs User Frontend plugin. An authenticated user who has subscriber level access or higher can inject arbitrary JavaScript into the 'wpuf_payment_method' parameter. Because the plugin uses the sanitize_text_field() function to isolate the gateway keyword but stores the full raw value, the malicious script is saved without proper escaping and later rendered unescaped in the page. This allows script execution in the context of any visitor who views the affected page.

WordPress installations that use the Wedevs User Frontend plug‑in with any released version up to and including 4.3.12 are affected. Versions newer than 4.3.12 are not impacted by this flaw.

The CVSS score of 6.4 indicates a medium severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalogue. The flaw requires that the attacker be able to log in with subscriber level or higher privileges. An attacker can craft a malicious payload, submit it through the payment method field, and any subsequent display of that value will trigger the attack. Because the vulnerability is server‑side stored, exploitation will affect all users who view the corrupted content.