EIP-2026-113758

The exploit describes a cross-site scripting (XSS) vulnerability in the flash-album-gallery WordPress plugin due to insufficient sanitization of user-supplied input in the 'pid' parameter of flagshow.php. An attacker can inject arbitrary script code to execute in the context of the affected site.