The Flickr Show plugin for WordPress contains a stored cross‑site scripting flaw that can be triggered through the 'div_height' parameter of the 'flickrshow' shortcode. When an authenticated contributor or higher level user specifies a malicious value, the input is saved without proper sanitization or escaping, leading to arbitrary JavaScript execution whenever a page containing the shortcode is viewed. This can enable attackers to steal session cookies, deface content, or deflect traffic to malicious sites.

WordPress sites that have installed Nuvuscripts' Flickr Show plugin version 1.5 or earlier are affected. Any site using this plugin, regardless of theme or other plugins, will be vulnerable if it exposes the shorter shortcode with a contributor who can edit or create posts.

The CVSS score of 6.4 indicates a moderate severity; however, the EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, which suggests a low likelihood of widespread exploitation at present. The attack requires authenticated access with at least contributor privileges, but once compromised the stored script persists and will execute for all users who view the impacted page.