The FL3R Accessibility Suite plugin for WordPress suffers from a stored cross‑site scripting flaw that allows an attacker to inject arbitrary JavaScript into content that is subsequently rendered to any user who views the affected page. The vulnerability is caused by inadequate input sanitization and output escaping when the fl3raccessibilitysuite shortcode processes user‑supplied attributes. Once the malicious payload is stored, it executes in the browser of every visitor to the injected page, compromising the confidentiality, integrity, and availability of user interactions with the site.

This issue affects the FL3R Accessibility Suite plugin, developed by armandofiore, in all releases up to and including version 1.4. The plugin runs on WordPress installations that enable the fl3raccessibilitysuite shortcode within posts or pages. Any site that has installed a vulnerable version of this plugin is susceptible.

The CVSS score of 6.4 marks the vulnerability as moderate, but the low EPSS score of less than 1% indicates that it is unlikely to be widely exploited at present. The flaw is not listed in the CISA KEV catalog, further suggesting limited real‑world impact as of now. An attacker must be authenticated with at least contributor privileges to craft and inject the malicious payload; the exploit typically occurs through the shortcode’s attribute fields. Once the payload is stored, it can affect all users who visit the affected page.