The vulnerability arises from the Flexi for WordPress plugin, which permits insufficient sanitization and escaping of user supplied attributes in the flexi‑form‑tag shortcode. An authenticated WordPress user with contributor-level access can embed malicious JavaScript that is stored and subsequently executed whenever the page containing the shortcode is viewed by any user. This Stored XSS can lead to session hijacking, defacement, or phishing attacks within the affected site, compromising both confidentiality and integrity of user data.

All installations of the Flexi plugin version 4.28 or earlier are susceptible. The issue is specifically tied to the flexi‑form‑tag shortcode handling in the plugin’s user interface. The affected environment is a WordPress site hosting the Flexi “Guest Submit” component.

With a CVSS score of 6.4, the exposure is considered moderate but significant. The EPSS score of less than 1% indicates a very low likelihood of mass exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. However, the attack surface requires an authenticated contributor or higher, which many sites may have, making the risk realistic for active sites. The most probable attack vector involves an attacker creating or editing a page that incorporates the flexi‑form‑tag shortcode to embed payloads that persist in the database.