The WP BookWidgets plugin’s 'bw_link' shortcode accepts user supplied attributes without sanitizing or escaping them. This flaw allows an authenticated contributor or higher to store malicious JavaScript that runs when the shortcode is rendered in any post or page. If an attacker successfully injects code, they can steal user sessions, deface content, or redirect visitors to phishing sites, compromising confidentiality, integrity, and availability of the website.

All releases of the WP BookWidgets plugin from the vendor remko up to and including version 0.9 are affected. Any WordPress site that has installed this plugin at those versions is vulnerable, regardless of the host platform, theme, or other plugins.

The listed CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild, though the vulnerability is still included in the public CVE database. It is not currently listed in the CISA KEV catalog, so no known exploited cases are public. Because the flaw requires prior authenticated access at least at the contributor level, the attack vector is internal; an attacker would need to compromise existing credentials or use an account granted such privileges. Once access is obtained, the stored XSS can be activated simply by any visitor visiting a page that contains the malicious shortcode.