An improper neutralization of script‑related HTML tags in the Brainstorm Force CartFlows plugin allows attackers to inject malicious JavaScript into pages rendered by the plugin. This Basic XSS vulnerability can cause defacement, execution of malicious scripts in users’ browsers, or theft of session credentials, and may be reflected or stored depending on how the content is entered. The impact is confined to the client side of the application and may facilitate further attacks such as phishing or credential harvesting when a user loads the compromised page.

The vulnerability affects all installations of the WordPress CartFlows plugin with a version of 3.3.0 or earlier. It is present throughout the range from the initial release to version 3.3.0 and is mitigated by updating to 3.3.1 or later.

The CVSS score of 5.3 indicates a moderate risk. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the injection of malicious code when a user views or edits a CartFlows element. The vulnerability does not require elevated privileges, implying that any authenticated user with edit rights could potentially propagate the attack to other site visitors through rendered content.