The wpeverest User Registration plugin versions up to 5.1.5 contain a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This allows an attacker to craft malicious input that is reflected in the web response, potentially leading to script execution in the context of the victim's browser. The vulnerability has a CVSS 3.1 base score of 7.1 with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this reflected XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user session. This may include theft of user credentials, session hijacking, or execution of arbitrary scripts in the victim's browser. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying input validation or output encoding workarounds if feasible. Monitor vendor channels for updates. No vendor advisory or official patch is currently available.