The WordPress Content Flipper plugin allows authenticated attackers with contributor‑level or higher access to inject arbitrary JavaScript through the bgcolor attribute of the flipper_front shortcode. Because the attribute is stored without proper sanitization or escaping, the injected script runs in the browser of any user who views the affected page, enabling malicious actions such as cookie theft, session hijacking, or further cross‑site attacks. The weakness is a classic stored cross‑site scripting flaw (CWE‑79).

Any WordPress site that has installed the WordPress Content Flipper plugin version 0.1 or earlier is affected. The vendor listed in the CNA data is aumsrini, and the insecure plugin is loaded as a WordPress plugin on the site.

The vulnerability scores a CVSS base score of 6.4, indicating a moderate severity. The EPSS score is less than 1%, suggesting that exploitation is unlikely in the near term. It is not listed in the CISA KEV catalog. The attack vector is authenticated: an attacker must first gain contributor or higher access to the WordPress site, after which the malicious script is injected into stored content and executed by any visitor to that page. No additional system prerequisites are required beyond the normal WordPress installation and exposed shortcode functionality.