The Multi Functional Flexi Lightbox plugin for WordPress suffers from a stored XSS vulnerability due to the `arv_lb_options_val()` sanitize callback returning user input without sanitization and the `message` value being output in the `genLB()` function without escaping. This allows authenticated users with administrator privileges to inject arbitrary web scripts that execute in the context of users viewing affected pages or posts. The vulnerability affects all versions up to and including 1.2. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An attacker with administrator-level access can inject persistent malicious scripts into pages or posts via the vulnerable parameter. These scripts execute in the browsers of users who view the affected content, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The impact is limited by the requirement for administrator privileges to exploit the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider disabling or replacing the vulnerable plugin to prevent exploitation.