The WP Flipclock plugin for WordPress, developed by Rhys Wynne, contains a DOM-based cross-site scripting vulnerability identified as CVE-2025-39540. This occurs because the plugin does not properly neutralize input during web page generation, allowing malicious scripts to execute in the context of the victim's browser. The issue affects all versions up to 1.9.1. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, requiring privileges and user interaction, with a scope change and limited impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected user's browser, potentially leading to limited disclosure of information, modification of data, or disruption of service. The scope of impact extends beyond the vulnerable component, affecting the broader security context of the application. However, no active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with this plugin, restrict its use to trusted environments, and consider disabling or removing the plugin if feasible. Monitor official sources for updates regarding patches or mitigations.