The WP Flipclock plugin up to version 1.9.1 contains an improper neutralization of input during web page generation, allowing attackers to inject malicious scripts into the page (DOM‑based XSS). This flaw permits an attacker to execute arbitrary client‑side code in the context of a visitor’s browser, potentially leading to session hijacking, defacement, or phishing. The weakness falls under CWE‑79 and could compromise all visitors rendering plugin output.

The vulnerability affects the Rhys Wynne WordPress WP Flipclock plugin for any WordPress installation that has the plugin installed in versions up to and including 1.9.1. No specific WordPress core or PHP version is required, and the issue manifests wherever the plugin outputs user‑controllable data to the page.

With a CVSS score of 6.5 the risk is moderate, while the EPSS score of less than 1 % indicates a low exploitation probability. The flaw is client‑side and does not require authentication, so any visitor can trigger the XSS by loading a page that incorporates the plugin. The vulnerability is not listed in CISA’s KEV catalog, so widespread exploitation is currently unlikely but remains a valid threat for exposed sites.