The issue is a stored cross‑site scripting flaw in the Flying Scripts WordPress plugin that allows an attacker to embed JavaScript in the comment field. The comment payload is sanitized in a way that bypasses WordPress core kses filtering because it uses only permitted tags and attributes. The attack succeeds after the comment is saved; the plugin’s output buffer then rewrites the content, placing the injected script inside an abbr title attribute. When a user views the page containing the comment, the script runs in the user’s browser. Because the vulnerability is stored and does not require privileged access, any unauthenticated visitor can trigger it by submitting a crafted comment.

WordPress sites running the gijo plugin named "Flying Scripts: Delay JavaScript to Improve Site Speed & Performance" in any release up through 1.2.4. The risk applies to all installations where the plugin is active, regardless of site size or user role. No further version constraints are provided beyond the stated upper bound of 1.2.4.

The CVSS score of 7.2 indicates a moderate to high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is unauthenticated via comment submission; no special privileges are needed. Because the payload can run in any user’s browser, the impact is wide‑ranging: data theft, credential phishing, or site defacement. The lack of a requirement for admission to the site makes it relatively easy for attackers to exploit. Given the moderate severity and the straightforward exploit path, the risk to any affected WordPress instance is considered significant.