The Fast Flow plugin for WordPress allows an attacker to inject malicious JavaScript into the page by exploiting improper input neutralization. The vulnerable code reflects user‑supplied data back to the browser without sufficient escaping or validation. When an attacker crafts a malicious payload and lures a victim to the target site, the script runs in the victim's browser, potentially hijacking sessions, stealing cookies, defacing content, or redirecting to malicious sites. The flaw is a classic reflected XSS vulnerability classified as CWE‑79.

The vulnerability impacts the Fast Flow minified dashboard plugin (fastflow:Fast Flow). All releases from the earliest known version up to and including version 1.2.16 are affected; versions newer than 1.2.16 are not impacted. The product runs on WordPress sites where the plugin is installed.

The CVSS score of 7.1 indicates a high severity, but the EPSS score of < 1% shows a very low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. The attack vector is a reflected input that requires a victim to click a crafted link or submit a crafted form, after which the malicious script executes in the victim’s browser. No elevated privileges or server‑side code execution are required.