The Print Button Shortcode plugin permits stored cross‑site scripting because the ‘target’ attribute passed to the ‘print‑button’ shortcode is neither sanitized nor escaped. Authenticated contributors and higher can inject arbitrary JavaScript that will run in the browsers of any user who views a page containing the malicious shortcode. This client‑side injection (CWE‑79) can lead to credential theft, session hijacking, defacement, or loading of additional malicious content, without affecting server‑side logic.

WordPress sites running chrishurst’s Print Button Shortcode plugin, versions up to and including 1.0.1. Any installation that uses the shortcode in page content is affected.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1 % shows a very low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. However, because the attack requires only a contributor‑level authenticated account, the risk remains noteworthy for sites that grant such permissions and the attack vector involves legitimate content‑editing privileges. Once the payload is stored, it executes for every visitor who accesses the affected page.