The Flashfader plugin for WordPress contains an improper neutralization of input during web page generation, allowing reflected XSS. A malicious attacker can craft a request that injects JavaScript into the plugin’s output, executing code in the context of a victim’s browser when the page is rendered. This flaw can lead to theft of session cookies, credential hijacking, defacement, or delivery of malware to users who visit the affected URL. The weakness is a classic input validation failure identified as CWE‑79.

WordPress installations employing the Flashfader plugin with any version from the earliest released build through 1.1.1 are at risk. The affected vendor is lynk, and the product is the Flashfader plugin.

The CVSS score of 7.1 indicates a high severity level, while the EPSS score of less than 1 % suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a crafted URL or form input that is reflected back to the user’s browser, making it readily exploitable by anyone with access to the site. Because no authentication or privilege escalation is required, the impact can be global to all visitors of the site.