The MyBrain Utilities plugin for WordPress is vulnerable to stored cross‑site scripting because it does not properly sanitize or escape user input supplied to the 'mbumap' shortcode. This flaw allows authenticated contributors or higher to inject arbitrary JavaScript that will run whenever any user views the affected content, enabling potential defacement or credential theft. The vulnerability is a classic stored XSS (CWE‑79).

Affected systems include the WordPress plugin MyBrain Utilities developed by markohoven. All releases from the first version up to and including 1.0.8 are impacted. The flaw resides in the plugin’s shortcode handling within the public class file.

The CVSS score of 6.4 indicates a medium‑severity vulnerability. The EPSS score of less than 1% suggests a very low likelihood of exploitation at present, and the flaw is not listed in the CISA KEV catalog. The attack vector requires an authenticated user with contributor‑level access or higher; such an attacker can add a malicious attribute to the mbumap shortcode in a post or page, which will then be stored in the database and executed for all subsequent page views.