The Digiseller plugin for WordPress allows an authenticated contributor or higher to insert arbitrary JavaScript code through the ds shortcode because the plugin does not properly escape user supplied attributes. When a page containing the shortcode is viewed, the malicious script executes in the browser context of any user who accesses that page, potentially leading to defacement, cookie theft, or session hijacking. This vulnerability is classified as CWE-79. Affected systems include the Digiseller WordPress plugin distributed under the digiseller:Digiseller product name. All releases up to and including version 1.3 are vulnerable. Users running any of these versions on a WordPress installation are at risk. The CVSS score of 6.4 indicates moderate severity. The EPSS figure of < 1% signals that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to be logged in with at least contributor privileges and to have the ability to create or edit content that includes the ds shortcode. Once injected, the attack is user‑agnostic, as any visitor to the affected page will execute the embedded script.

The affected vendors and products are the Digiseller WordPress plugin, distributed under the digiseller:Digiseller product name. All plugin releases up to and including version 1.3 are vulnerable. The flaw applies to any WordPress installation that has the Digiseller plugin installed at a vulnerable version and allows authenticated users with contributor or higher privileges to add or edit content containing the ds shortcode.

The CVSS score of 6.4 indicates a moderate severity risk for the affected systems. The EPSS value of < 1% reflects a very low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires an authenticated user with contributor or higher privileges who can insert or edit content using the ds shortcode, after which any visitor to the page will run the embedded script. Attackers could therefore hijack sessions or manipulate the user experience for unauthenticated visitors, but the scope is limited to sites using the vulnerable plugin version.