EIP-2026-113756

The FlagEm plugin for WordPress is vulnerable to a cross-site scripting (XSS) attack due to insufficient input sanitization in the 'cID' parameter of flagit.php. An attacker can inject arbitrary JavaScript code, which executes in the context of the victim's browser session.