The Shortcodes and extra features for Phlox theme WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) in its Accordion Widget. This occurs because the plugin fails to properly sanitize and escape user input before rendering it on web pages. Authenticated attackers with contributor-level access or higher can exploit this to inject arbitrary JavaScript code that executes in the context of users viewing the compromised page. This vulnerability affects all versions up to 2.15.5. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and limited confidentiality and integrity impact without availability impact. No patch or official fix information is currently available.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages via the Accordion Widget. These scripts execute in the browsers of users who visit the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability impacts confidentiality and integrity but does not affect availability. No known active exploitation has been reported.

No official patch or vendor advisory is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, limit contributor and higher privileges to trusted users only. Consider disabling or removing the Accordion Widget feature if feasible. Monitor for updates from the plugin vendor and apply patches promptly once available.