This vulnerability in Ren Ventura's WP Delete User Accounts plugin (<= 1.2.4) allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker with privileges can inject malicious scripts that persist and execute when other users view the affected content, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 score of 6.5 reflects a medium severity with network attack vector, low complexity, requiring privileges and user interaction, and scope change. No patch or official fix information is currently provided, and no exploits are known in the wild.

Successful exploitation can lead to execution of arbitrary scripts in the context of users viewing the affected pages, potentially allowing theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The vulnerability requires attacker privileges and user interaction, limiting its ease of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should limit plugin usage to trusted users with minimal privileges and consider disabling or removing the plugin if possible. Monitor official Ren Ventura communications for updates and apply patches promptly once released.