The vulnerability is an improper neutralization of user‑supplied input during web page generation in the FLX Dashboard Groups plugin, allowing reflected XSS. When an attacker supplies specially crafted data that the server echoes back, malicious JavaScript can be executed in the victim’s browser. Based on the description, it is inferred that such execution could lead to session hijacking, credential theft, defacement or other client‑side compromise.

WordPress installations running the FLX Dashboard Groups plugin version 0.0.7 or earlier are affected. Administrators should verify the installed plugin version and upgrade or remove the plugin if it is out of date.

The CVSS score of 7.1 indicates a high impact, yet the EPSS score of less than 1 % shows that exploitation likelihood is low and the vulnerability is not listed in CISA KEV. The likely attack vector is a crafted URL or form input that is reflected back to the user; the attacker can lure the target to a malicious link to trigger the XSS, which is inferred from standard XSS exploitation patterns.