The vulnerability arises from improper neutralization of user‑supplied input within the UX Flat plugin, permitting stored cross‑site scripting (XSS). Attackers can inject malicious scripts that are retained in the database and executed during normal page rendering, granting them the ability to steal session cookies, deface content, or redirect users to phishing sites.

Affected systems include the WordPress UX Flat plugin, manufactured by COP. Versions from the unspecified initial release through 5.4.0 are vulnerable. Site operators using these versions are at risk unless a newer, unvulnerable release is installed.

The CVSS score of 6.5 reflects moderate severity, and the EPSS score indicates a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation likely requires an attacker to submit input that the plugin stores; the exact prerequisites, such as authentication level, are not detailed. Given the low EPSS, the threat is moderate but any stored XSS can have significant impact on affected users.