The Clicface Trombi plugin, versions 2.08 and earlier, contains a stored cross‑site scripting flaw that allows any user with Contributor or higher access to inject arbitrary JavaScript through the ‘nom’ parameter. Because the input is neither sanitized nor properly escaped, the malicious code is persisted in the database and will execute in the browser of any visitor who loads the affected page. This can lead to session hijacking, credential theft, or defacement of the site in the context of the user viewing the page.

All WordPress installations that have the Clicface Trombi plugin installed with a version equal to or lower than 2.08 are affected. The vulnerability is independent of the WordPress core version and impacts any contributor‑level role that can supply the nom parameter.

The CVSS v3 score of 6.4 indicates a moderate severity, but the EPSS score of less than 1% and the lack of listing in the CISA KEV catalog suggest a low likelihood of current exploitation. Because the flaw requires authenticated access, an attacker must first be able to log in with at least Contributor privileges. Once an injection is stored, any page viewed by other users will execute the malicious script. The attack vector is therefore an authenticated, web‑based exploitation that does not rely on network-level vulnerabilities.