The Shortcodes and extra features for Phlox theme WordPress plugin suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input in the 'title_tag' parameter. This allows authenticated users with contributor or higher privileges to inject arbitrary web scripts that persist in the application and execute in the context of users visiting the injected pages. The vulnerability affects all versions up to 2.15.7 and has a CVSS 3.1 base score of 6.4, indicating a medium severity. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation allows an authenticated contributor-level or higher user to inject malicious scripts that execute in the browsers of users viewing the compromised pages. This can lead to theft of user credentials, session hijacking, or other actions performed with the victim's privileges. The impact is limited by the requirement for authenticated access with contributor or higher permissions and does not affect unauthenticated users directly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation.