The vulnerability is a reflected Cross‑Site Scripting (XSS) flaw caused by insufficient sanitization of user data when generating web pages. An attacker can embed malicious JavaScript that executes in the victim's browser, enabling possible session hijacking, cookie theft, phishing, or defacement of the WordPress site. This weakness presents a risk of compromising user confidentiality, integrity, and services through script injection.

The affected product is the WordPress CoolHappy Cool Flipbox – Shortcode & Gutenberg Block plugin, versions from the first release up through 1.8.3. Any WordPress installation using this plugin version range is vulnerable.

The reported CVSS base score is 7.1, indicating a high level of risk. The EPSS score of less than 1% shows a low probability of exploitation at this time, and the vulnerability is not currently listed in CISA's KEV catalog. Likely exploitation would rely on a user visiting a crafted URL or entering malicious data into a field rendered by the plugin. The attack requires access to the site’s front‑end, making external threat actors capable of triggering the flaw if they can entice users to click or if the site processes untrusted input. Overall risk is moderate, but mitigation is advised.