The Post Flagger plugin contains a stored cross‑site scripting flaw in the 'flag' shortcode. The 'slug' attribute is not properly sanitized, allowing an attacker with at least contributor privileges to insert arbitrary HTML or JavaScript into post or page content. When a visitor accesses the page, the injected script runs in their browser, potentially exposing the site to further exploitation or user defacement.

WordPress sites that use the Post Flagger plugin from nosoycesaros version 1.1 or earlier are affected. The vulnerability exists in all released versions up to 1.1 and is tied to the code that processes the shortcode in post-flagger.php. Users who have contributed content through the plugin are able to inject the malicious payload.

The CVSS base score of 6.4 indicates a moderate severity. No EPSS score is available and the issue is not listed in the CISA KEV catalog, suggesting that there is limited or no known exploitation in the wild at this time. Exploitation requires only contributor access, which is commonly granted on multi‑author WordPress installations. The overall risk remains moderate, but because the impact affects every visitor to affected pages, sites with high traffic or sensitive content should treat it as a priority concern.