This vulnerability in azzaroco Ultimate Membership Pro (<= 12.7) involves improper neutralization of input during web page generation, leading to a cross-site scripting (XSS) flaw. An attacker could exploit this to execute arbitrary scripts in a victim's browser, potentially affecting user data confidentiality, integrity, and availability. The CVSS 3.1 vector indicates the attack can be performed remotely with low complexity and no privileges, requiring user interaction, and impacts multiple security properties.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to information disclosure, modification of data, or disruption of service. The CVSS score of 7.1 reflects a high impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with input handling and consider applying any recommended temporary mitigations from the vendor once published.