The plugin stores link titles without proper sanitization or encoding, allowing an attacker who can edit a link title to inject malicious JavaScript. When a victim visits a page that displays the stored title, the code executes in their browser. The injected script can perform a range of malicious actions such as stealing session cookies, defacing content, or redirecting to phishing sites. This is a classic stored cross‑site scripting flaw (CWE‑79).

Affected systems are installations of the WordPress ClickWhale plugin, version 2.4.1 and earlier. The vendor is Flowdee, and the plugin is available from the WordPress plugin repository. Administrators who run an instance that has not upgraded past 2.4.1 are vulnerable.

The vulnerability has a CVSS score of 6.4, placing it in the medium severity range. Its EPSS score is below 1 %, indicating a very low probability of exploitation at this time. It is not listed in the CISA KEV catalog. The description states that the flaw is exploitable by authenticated users with Contributor-level permissions or higher; the likely attack path is through the WordPress admin interface where the attacker can modify a link title. Because an attacker must first obtain legitimate credentials, the overall risk is mitigated compared to a purely unauthenticated vulnerability, but the potential impact remains significant.