The WP Easy Toggles plugin allows a contributor or higher‑privileged user to inject arbitrary JavaScript through the shortcode’s attributes. On submission the plugin stores the payload and later outputs it without proper sanitization or escaping, resulting in Stored Cross‑Site Scripting. An attacker who successfully injects a script can steal session cookies, perform account hijacks, deface pages, or trick users into executing malicious actions without their knowledge. The flaw is identified as CWE‑79.

Any WordPress site that has the WP Easy Toggles plugin by husainahmedqureshi installed in a version 1.9.0 or earlier. The vulnerability is present in all releases up to and including 1.9.0 and affects every shortcode instance that accepts user‑supplied attributes.

The vulnerability has a CVSS score of 6.4, indicating moderate severity. The EPSS score is less than 1%, implying a low probability of exploitation at the time of this analysis. It is not listed in the CISA KEV catalog, so there is no known, active exploitation. Exploitation requires an authenticated attacker with contributor-level access or higher, who can submit a malicious shortcode that is later rendered in a page accessible to other users.