EIP-2026-113800

The code describes a cross-site scripting (XSS) vulnerability in the GRAND FlAGallery WordPress plugin, where user-supplied input via the 'pid' parameter in 'flagshow.php' is not properly sanitized. This allows arbitrary script execution in the context of the affected site.