The Flask Micro code‑editor plugin for WordPress is vulnerable to stored cross‑site scripting through the codeflask shortcode. The vulnerability arises from insufficient sanitization of the 'title' attribute, allowing authenticated users with contributor‑level access or higher to embed arbitrary JavaScript. Any user who loads a page containing the malicious shortcode will have the injected script executed in their browser, potentially compromising session data or defacing the site.

This flaw affects all installations of the Flask Micro code‑editor plugin version 1.0.0 and earlier. The plugin is available for WordPress sites as an add‑on. Users running these versions should identify the plugin in their WordPress installation and verify the current version before applying a fix.

The CVSS base score of 6.4 indicates moderate severity. An attacker must be authenticated as a contributor or higher and must be able to insert or edit the codeflask shortcode, which is commonly provided to content authors. The EPSS score of less than 1% suggests a low probability that this flaw is being actively exploited, and the vulnerability is not listed in the CISA KEV catalog. However, once an attacker succeeds, the stored script runs for every visitor to the impacted page, creating a serious threat to user data and site integrity.