Technical impact
The vulnerability exists in the WP Shortcodes Plugin ‑ Shortcodes Ultimate up to version 7.3.3. It allows an authenticated user with Contributor permission or higher to inject arbitrary JavaScript via the src parameter. The injected payload is stored in the plugin’s settings and executes in the browser of any visitor to the affected page, potentially compromising the visitor’s session or enabling phishing attacks. The weakness is an instance of insufficient input sanitization combined with missing output escaping, matching CWE‑79.
Affected Systems
All installations of the Shortcodes Ultimate plugin version 7.3.3 or earlier are affected. This includes any WordPress site that has the plugin from the official repository and has not applied newer releases. The breach can occur in any virtual host where the plugin is active, regardless of platform or site architecture, as the issue is purely in the plugin code.
Risk and Exploitability
The CVSS base score of 6.4 indicates moderate severity, and the EPSS of 37% suggests a non‑negligible probability of exploitation in the near term. The exploit requires the attacker to be logged in with at least contributor rights, but once authenticated they can inject a malicious payload that will be executed for every page visitor, providing a persistent attack surface. The vulnerability has not yet been reported in the CISA KEV catalog, but its moderate CVSS and significant EPSS underscore the need for timely remediation.
EUVD