The Shortcodes and extra features for Phlox theme plugin for WordPress allows authenticated users with Contributor‑level access or higher to store malicious scripts through the 'tag' and 'title_tag' parameters used by the Modern Heading widget. This stored cross‑site scripting flaw is a classic input validation weakness (CWE‑79) that can lead to arbitrary script execution when a victim views the affected page, potentially compromising confidentiality, integrity, or leading to defacement. The impact is confined to pages where the malicious heading is rendered, but any user who visits those pages will have the injected code executed in their browser, allowing further attacks such as cookie theft or phishing.

Shortcodes and extra features for Phlox theme plugin for WordPress, versions up to 2.17.13. All users running WordPress sites that have installed this plugin and have a Contributor‑level or higher role can be affected.

The CVSS score of 6.4 indicates a medium severity vulnerability. The EPSS score of less than 1% suggests a low exploitation likelihood at present. It is not listed in CISA KEV. Exploitation requires authenticated access and the ability to edit page content via the Modern Heading widget; the attacker must supply crafted 'tag' or 'title_tag' values that bypass the plugin’s limited sanitization.