The vulnerability allows an attacker to store malicious script code in the TNC FlipBook plugin’s content fields, which is later rendered directly on the web page without proper escaping. This stored XSS can be used to steal user cookies, hijack sessions, deface the site, or deliver further malicious payloads. The weakness is a classic Cross‑Site Scripting flaw (CWE‑79).

The affected product is the WordPress TNC FlipBook plugin from ThemeNcode. All releases through version 12.1.0 are impacted; versions newer than 12.1.0 are not listed as vulnerable.

The CVSS score is 6.5, indicating a moderate severity vulnerability. The EPSS score is less than 1 %, implying that the likelihood of exploitation at the time of analysis is very low. The vulnerability is not included in CISA’s KEV catalog. An attacker would likely need to inject the payload via an account that has permission to edit or upload content within the plugin, producing a stored script that executes in the browsers of other site visitors. Based on the description, it is inferred that the attack vector would generally be local to the plugin’s administration interface, though a remote attacker could gain such access if privileged credentials are compromised. Given the moderate severity and low exploitation probability, a priority patch is recommended to eliminate the risk entirely.