The Shortcodes Bootstrap plug‑in for WordPress stores the raw content supplied in the ‘type’ attribute of its [notification] shortcode when a page is saved. Because the value is neither sanitized nor escaped before being written to the database or rendered, malicious JavaScript can be inserted and later executed in the browser of any user who views the affected page. The flaw allows an attacker who can edit or create a notification to place arbitrary code that will run automatically for each site visitor, presenting the possibility of script execution within the user’s session context.

All installations of the Shortcodes Bootstrap plug‑in version 1.1 or earlier are vulnerable. Exploitation is limited to WordPress accounts with the Contributor role or higher, including authors, editors, and administrators, who can insert or edit the notification shortcode.

The CVSS score of 6.4 classifies this vulnerability as moderate. The EPSS score of less than 1% indicates that, as of this assessment, the likelihood of observed exploitation is low. The flaw is not listed in the CISA KEV catalog. Successful exploitation requires an authenticated session for a user with contributor-level access, the ability to inject the ‘type’ parameter into the shortcode, and subsequent viewing of the affected page by site visitors. Once the malicious code is stored, it will execute automatically in the browsers of anyone who loads the page containing the shortcode, without any additional user interaction.