The WP Flow Plus plugin (<= 5.2.3) contains a stored cross-site scripting vulnerability due to improper input neutralization in the wp-imageflow2 component. This flaw allows an attacker with low privileges to inject malicious scripts that execute when a user views the affected page, potentially leading to partial compromise of confidentiality, integrity, and availability. The vulnerability requires user interaction and network access to exploit. No patch or official fix has been documented yet.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially allowing attackers to steal sensitive information, manipulate content, or disrupt service. The CVSS vector indicates low attack complexity, low privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability, all at a low level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting user input that can be rendered by the wp-imageflow2 component and applying web application firewall (WAF) rules to detect and block XSS payloads related to this plugin. Monitor vendor channels for updates and apply patches promptly once available.