The WP Photo Effects plugin is vulnerable to a stored cross‑site scripting flaw triggered through its "wppe_effect" shortcode. Insufficient sanitization and output escaping of user‑supplied shortcode attributes allow an attacker with contributor or higher privileges to embed arbitrary JavaScript. This script runs automatically whenever any site visitor loads a page containing the injected shortcode, creating opportunities for credential theft or defacement.

The flaw affects the WP Photo Effects WordPress plugin version 1.2.4 and all earlier releases. The vendor is muhammad‑rehman, and the plugin is a common WordPress component used on many sites. An attacker must be authenticated at the contributor level or higher to inject the malicious shortcode.

Based on the description, it is inferred that the attack vector is a web‑based content editor that accepts shortcode usage. The CVSS score of 6.4 denotes moderate severity, while the EPSS score of < 1 % indicates a very low likelihood of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Because authentication is required, the risk is confined to sites where contributors have the ability to edit content; however, once a malicious shortcode is planted, every visitor to that page becomes exposed to the injected script.