The Bulma Shortcodes WordPress plugin is vulnerable to stored cross‑site scripting because the ‘type’ attribute of the bulma‑notification shortcode is not sanitized or escaped. An authenticated user with contributor‑level or higher privileges can place arbitrary JavaScript into the attribute, and that code is stored in the post content and served to any user who views the page. When a visitor loads a page containing the injected shortcode, the script executes in the visitor’s browser, allowing the attacker to run arbitrary client‑side code.

Every installation of the Bulma Shortcodes plugin version 1.0 or earlier is affected. The sole vendor listed by the CNA is bartboy011 for the Bulma Shortcodes product. No newer version is indicated in the advisory as a fix.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score of below 1 % suggests a low probability of exploitation. The vulnerability is not listed in CISA KEV, so no widespread exploitation is known. The likely attack vector requires an attacker who already has authenticated contributor or higher access to the site, typically by logging into the WordPress admin area and inserting malicious content via the shortcode feature. Once the malicious code is stored, it will affect all subsequent visitors who view the page containing the shortcode.