The Skip to Timestamp WordPress plugin allows stored Cross‑Site Scripting through its "skipto" shortcode. The vulnerability stems from insufficient input sanitization and output escaping of the "time" attribute. An authenticated attacker with contributor or higher privileges can inject JavaScript that will execute for any user who views a page containing the malicious shortcode.

WordPress installations running Skip to Timestamp plugin versions 1.4.4 or earlier are impacted. The vulnerability applies to all sites deploying the open‑source Skip to Timestamp plugin through the WordPress plugin repository.

The CVSS score of 6.4 indicates a medium‑to‑high severity, while the EPSS score of less than 1% suggests the likelihood of exploitation remains low at present. The flaw is not currently listed in the CISA KEV catalog. Exploitation requires a legitimate contributor‑level account that can edit content and insert shortcodes, so the attack vector is authenticated and limited to users with authoring privileges. Once injected, the payload is stored and executed on every page view.