The Structured Content (JSON‑LD) #wpsc plugin for WordPress contains a stored cross‑site scripting flaw in the sc_fs_local_business shortcode. The vulnerability arises because the plugin does not properly sanitize or escape user‑supplied shortcode attributes, allowing an authenticated user with contributor or higher privileges to persist malicious JavaScript in the post content. When a victim visits the affected page, the injected script runs in the victim’s browser, potentially enabling credential theft, session hijacking or other client‑side attacks.

The flaw affects all installations of gorbo’s Structured Content (JSON‑LD) #wpsc plugin up to and including version 6.4.5, which is widely used in WordPress sites that implement the sc_fs_local_business shortcode.

The CVSS base score is 6.4, indicating a moderate severity issue, while the EPSS score of less than 1 % suggests a low probability of exploitation at the moment. The vulnerability is not listed in the CISA KEV catalog, which further indicates it is not a widely known, actively exploited vulnerability. Attackers must first authenticate as a contributor or higher and then insert the malicious payload through the shortcode. Once added, the script remains stored and executes for every site visitor, representing a persistent XSS threat that can be leveraged for client‑side attacks such as phishing or theft of sensitive data.