The vulnerability is a Stored Cross‑Site Scripting flaw that arises from improper neutralization of user‑supplied input during web page generation. A malicious actor can embed script code that will be executed in the browsers of any user who views the affected content, potentially allowing session hijacking, defacement, or the delivery of additional malware. The weakness is identified as CWE‑79.

The flaw is present in the Spiffy Plugins WP Flow Plus "wp‑imageflow2" plugin and affects all versions from the earliest release up to and including 5.2.5.

The CVSS score of 5.9 indicates a medium severity level, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely need to inject malicious payloads through the plugin’s content entry points or through existing stored data, implying that authentication or administrative privileges may be required to create or modify affected content.