The vulnerability allows authenticated users with contributor or higher privileges to store malicious JavaScript within the row shortcode of the Memberlite Shortcodes plugin. Once stored, the script is served to anyone who visits the affected page, producing a classic stored XSS that can result in session hijacking, credential theft, or defacement. This weakness arises from failure to sanitize or escape user‑supplied attributes, and is identified as CWE‑80.

WordPress sites running the Memberlite Shortcodes plugin from the developer Stranger Studios, in any version up to and including 1.4. All installations of these versions are susceptible.

The CVSS score of 6.4 places the flaw in the moderate range, while an EPSS score of less than 1% indicates a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. Exploitation requires authentication at the contributor level or higher, and the attacker must have permission to create or edit content using the plugin. Once satisfied, the stored payload will execute in users’ browsers whenever the shortcode renders.