The Eulerpool Research Systems WordPress plugin contains a stored cross‑site scripting flaw in its 'aaq' shortcode, where insufficient input sanitization allows an attacker with contributor‑level or higher access to insert arbitrary scripts that run whenever a page containing the shortcode is viewed. This can lead to site defacement, cookie theft, session hijacking, or other malicious actions performed as the visiting user. The weakness is a classic stored XSS, identified as CWE‑80.

The vulnerable product is the Eulerpool Research Systems plugin, version 4.0.1 and all earlier releases, supplied by the vendor michaellow. All WordPress sites running any of these versions are affected and are at risk if contributors are allowed to add or edit content.

The CVSS score is 6.4, indicating medium severity, while the EPSS score is below 1%, suggesting a low likelihood of exploitation at present. This vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authenticated access, a threat actor would need to be an existing contributor or higher; however, once authenticated, a malicious contributor can very easily inject scripts that compromise subsequent site visitors.