The Travelfic Toolkit WordPress plugin contains an input handling flaw that allows stored cross‑site scripting. A malicious user can inject arbitrary JavaScript that is persisted in the site's database and subsequently rendered in webpages served to visitors. The vulnerability is identified as CWE‑79 and can compromise the integrity of web content presented to users.

All installations of the Themefic Travelfic Toolkit WordPress plugin with versions up to and including 1.2.1 are affected. Site operators using this plugin on any WordPress website are at risk unless they upgrade beyond the stated version threshold.

The CVSS score of 6.5 indicates a medium‑severity flaw, and the EPSS score of less than 1% suggests a low probability of active exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is through administrative input fields in the plugin where malicious JavaScript can be stored and later served to site visitors; this inference is drawn from the stored‑XSS nature of the flaw.