This vulnerability, identified as CWE-79, involves improper neutralization of input in the Profile Extra Fields plugin by BestWebSoft, versions up to 1.3.4. It permits subscriber-level users to perform cross-site scripting attacks by injecting malicious code into web pages generated by the plugin. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges at the subscriber level, user interaction needed, and impacts on confidentiality, integrity, and availability at a low to medium level. No patch or official remediation level has been published as of the current data.

Successful exploitation could allow an attacker with subscriber privileges to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure, modification of data, or disruption of service. The impact is rated medium based on the CVSS score and the need for user interaction and privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting subscriber input or applying web application firewall rules to detect and block XSS payloads related to this plugin.