The WPSite Shortcode plugin for WordPress allows stored cross-site scripting through the unsanitized "format" attribute of the wpsite_y shortcode and the "before" attribute of the wpsite_postauthor shortcode in all versions up to 1.2. By injecting malicious JavaScript in these attributes, an authenticated user with contributor or higher privileges can store scripts that execute whenever any user views a page containing the shortcode, enabling potential session hijacking, data theft, or site defacement.

All installations of the WPSite Shortcode plugin for WordPress where the version is 1.2 or older. The affected vendor is wpfanyi and the plugin names as listed. Users who possess contributor or higher level permissions are able to exploit the flaw; thus any WordPress site running the vulnerable plugin with such user accounts is at risk.

The vulnerability carries a CVSS score of 6.4, classifying it as a moderate severity issue. The EPSS score is under 1%, indicating a very low probability of exploitation in the wild. It is not included in the CISA KEV catalog. Because the flaw requires authenticated access, attackers need at least contributor privilege to inject malicious payloads. Exploitation is achieved by posting a content piece that includes the malicious shortcode, which is then stored and rendered for all site visitors.