An authenticated user with contributor‑level or higher can exploit the 'column_count' parameter in the [display-pages] shortcode caused by inadequate input sanitization. This allows the user to store malicious JavaScript that will run whenever anyone views the affected page, enabling credential theft, defacement, or execution of arbitrary client‑side code. The vulnerability is a stored cross‑site scripting flaw (CWE‑79) that can persist within stored content and affect all visitors to the page.

The issue targets the Display Pages Shortcode plugin produced by Rustybadrobot for WordPress. All releases <= 1.1 are affected; versions after 1.1 are presumed patched.

With a CVSS score of 6.4 the vulnerability is considered moderate severity. The EPSS score of less than 1% indicates a very low exploitation probability in the current threat landscape, and it is not listed in the CISA KEV catalog. However, because the flaw requires only contributor‑level access – a role commonly granted on many WordPress sites – and allows injection of arbitrary scripts that affect every visitor to a page, the risk to user sessions and data integrity can be significant. Attackers must first authenticate to the site, craft the malicious shortcode payload, place it on a page, and then wait for other users to visit that page for the script to execute.