The vulnerability exists in the WP Shortcodes Plugin — Shortcodes Ultimate up to version 7.3.3. It allows an authenticated user with Contributor permission or higher to inject arbitrary JavaScript via the src parameter. The injected payload is stored in the plugin’s settings and executes in the browser of any visitor to the affected page, potentially compromising the visitor’s session or enabling phishing attacks. The weakness is an instance of insufficient input sanitization combined with missing output escaping, matching CWE‑79.

All installations of the Shortcodes Ultimate plugin version 7.3.3 or earlier are affected. This includes any WordPress site that has the plugin from the official repository and has not applied newer releases. The breach can occur in any virtual host where the plugin is active, regardless of platform or site architecture, as the issue is purely in the plugin code.

The CVSS base score of 6.4 indicates moderate severity, and the EPSS of 6% suggests a non‑negligible probability of exploitation in the near term. The exploit requires the attacker to be logged in with at least contributor rights, but once authenticated they can inject a malicious payload that will be executed for every page visitor, providing a persistent attack surface. The vulnerability has not yet been reported in the CISA KEV catalog, but its moderate CVSS and moderate EPSS underscore the need for timely remediation.