The gopiplus Card flip image slideshow plugin is vulnerable to improper neutralization of input, resulting in DOM‑based XSS. This flaw allows an attacker to inject malicious script into the slideshow rendering process, enabling the execution of arbitrary code in a victim’s browser. The impact includes potential cookie theft, session hijack, defacement, or other client‑side attacks, as described by CWE‑79.

WordPress users who have installed the Card flip image slideshow plugin version 1.5 or earlier, from initial release through < = 1.5, are affected. The plugin is distributed by the vendor gopiplus.

The vulnerability has a CVSS score of 6.5, indicating a medium severity rating. The EPSS score of < 1% suggests a low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Attackers would exploit the flaw by crafting a malicious image or slideshow configuration that includes code executed in the victim’s browser when the slideshow is viewed. Because it is DOM‑based, the attack is performed client‑side via a normal webpage load.