Improper neutralization of input during web page generation results in a stored cross‑site scripting vulnerability in the Dr. Flex WordPress plugin. Attackers can inject malicious scripts into content that the plugin records, allowing those scripts to run when any visitor loads the affected page. This can lead to theft of session cookies, defacement, or delivery of phishing payloads.

WordPress sites that have the Dr. Flex plugin from any version up to and including 2.0.0 installed on a compatible WordPress installation.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests the likelihood of exploitation is low at present. The vulnerability is not listed in CISA's KEV catalog. The attack vector is likely through the plugin’s content submission or editing interface, which stores input without proper sanitization. An attacker would need to supply malicious payloads that the plugin accepts and later displays to other users.