This vulnerability in Spiffy Plugins WP Flow Plus (<= 5.2.5) involves improper neutralization of input during web page generation, resulting in stored cross-site scripting (XSS). An attacker with high privileges and requiring user interaction could exploit this to execute arbitrary scripts in the context of affected users. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and impacts on confidentiality, integrity, and availability at a low level.

Successful exploitation could allow an attacker with high privileges to inject and execute malicious scripts in the context of other users, potentially leading to information disclosure, modification of data, or disruption of service. The impact is rated as medium severity with limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently documented, users should monitor vendor communications for updates. Until a fix is available, restricting high-privilege user access and limiting user interaction with untrusted content may reduce risk.