The Reuse Builder plugin allows authenticated users with contributor-level access or higher to store malicious scripts by injecting them through the style attribute used by the reuse_builder_single_post_title shortcode. The injected script is stored in the database and rendered on any page that includes the shortcode, enabling the attacker to execute arbitrary JavaScript in the context of a site visitor. This vulnerability results in a confidentiality and integrity breach for the site’s users, while also giving attackers the ability to deface content or redirect users.

The flaw affects all installations of the Reuse Builder plugin for WordPress up to and including version 1.7. Users running version 1.7 or prior are at risk unless they have applied a patch or workaround. The vendor, redq, does not provide a specific update listing in the data but the issue is reported for the 1.7 release and earlier.

The CVSS score of 6.4 indicates a medium severity vulnerability. A low EPSS score (< 1%) suggests that, at the time of this analysis, exploitation attempts are rare, and the plugin is not currently listed in the CISA KEV catalog. The likely attack vector requires authenticated access at contributor level or higher and relies on the ability to add or edit content that includes the shortcode. Successful exploitation results in the execution of attacker‑controlled scripts on any page that renders the affected shortcode.