The vulnerability is a stored XSS flaw that allows an attacker with contributor‑level access or higher to execute arbitrary web scripts on any page containing the Markdown Shortcode plugin. The injected scripts run in the browsers of all users who view the affected page, enabling phishing, credential theft, or session hijacking. This weakness maps to CWE‑79, underscoring deficiencies in input sanitization and output escaping.

All WordPress sites that use the Markdown Shortcode plugin in a version up to and including 0.2.1 are affected. Versions 0.2.3 and newer contain the patch, so administrators should verify that such sites are running at least 0.2.3 or have removed the plugin.

The CVSS score of 6.4 indicates moderate severity, while the EPSS value of < 1% shows a low current exploitation probability; the vulnerability is not listed in the CISA KEV catalog. Attackers must first be authenticated with contributor or higher privileges to plant the malicious payload, so the risk is greatest in environments where such roles have access to edit content. Exploitation conditions are limited to the presence of the plugin and the injection of an attribute within a shortcode, after which the payload is rendered on page load for all visitors.