The Flexi – Guest Submit plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of user-supplied input in the flexi-form-tag shortcode. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript code that is stored and executed in the context of users visiting the affected pages. This vulnerability affects all versions up to 4.28. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required at the contributor level, no user interaction needed, and impacts on confidentiality and integrity but not availability. No vendor advisory or patch links are provided, and no known exploits in the wild have been reported.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts into WordPress pages via the flexi-form-tag shortcode. This can lead to unauthorized actions performed in the context of other users, potentially compromising confidentiality and integrity of user data or site content. Availability is not impacted. The vulnerability requires authenticated access at contributor level, limiting the attack surface to users with some level of trust on the site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should restrict contributor-level access to trusted users only and consider disabling or removing the Flexi – Guest Submit plugin if possible. Monitoring for unusual script injections in pages using the flexi-form-tag shortcode is advisable. Avoid granting contributor or higher privileges to untrusted users.