The manu225 Flipping Cards plugin version 1.30 and earlier contains a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows an attacker with high privileges and user interaction to inject malicious scripts that can execute in the context of other users, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction needed, and scope change.

Successful exploitation can lead to partial disclosure of information, modification of data, and disruption of service within the affected application context. The vulnerability requires an attacker to have high privileges and user interaction, limiting the ease of exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict high-privilege user access and exercise caution with user-generated content in the Flipping Cards plugin. Monitor vendor channels for updates and apply official patches promptly once released.