The TweetThis Shortcode plugin for WordPress contains a stored cross‑site scripting vulnerability. Insufficient sanitization and escaping of user supplied attributes in the plugin's shortcode allow an attacker to embed arbitrary JavaScript code, which is then persisted in the post content. When a victim views the modified page, the injected script executes in the victim’s browser, potentially exposing session cookies, credentials, and enabling other client‑side attacks. The flaw is a classic instance of CWE‑79.

All installations of the TweetThis Shortcode plugin with versions 1.8.0 or earlier are impacted. The affected product is provided by douglaskarr:TweetThis Shortcode and is distributed as a WordPress plugin. Updating to any version newer than 1.8.0, if available, removes the flaw.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1% shows that the probability of exploitation is very low at present, and the vulnerability is not currently listed in CISA KEV. Exploitation requires an authenticated WordPress account with contributor or higher privileges to add or edit content that includes the shortcode. The attack vector is an authenticated user who submits malicious attributes via the plugin’s interface, so it is limited to sites that allow contributors to edit posts. Once the payload is stored, any user who visits the impacted page will trigger the JavaScript execution.