The WP ViewSTL plugin contains a stored XSS vulnerability in the ‘viewstl’ shortcode that allows authenticated users with contributor or higher privileges to inject arbitrary scripts through unsanitized shortcode attributes. Once stored, these scripts execute whenever a page containing the shortcode is viewed, enabling attackers to hijack sessions, deface content, or deliver malware. This weakness is classified as CWE‑79.

The vulnerability affects all installations of falldeaf’s WP ViewSTL WordPress plugin up to and including version 1.0. Any site using the plugin at or below that version is susceptible, regardless of the underlying WordPress core revision.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of <1% suggests exploitation is unlikely to be widespread. The flaw is not listed in CISA’s KEV catalog. Attackers must be authenticated with contributor or higher role; they can exploit the flaw by inserting malicious attributes into the viewstl shortcode in editable content, which the plugin stores and renders for all viewers, thereby granting arbitrary script execution. This poses significant risks to confidentiality, integrity, and availability for affected users.