The Simple Tableau Viz WordPress plugin contains a stored cross‑site scripting flaw in the ‘tableau’ shortcode that permits authenticated users with contributor-level access or higher to inject arbitrary JavaScript via unsanitized shortcode attributes. When a user accesses a page containing the malicious shortcode, the injected script runs in the victim’s browser, enabling defacement, credential theft, or malicious redirects. This flaw arises from insufficient input sanitization and output escaping within the plugin code.

The vulnerability affects the Simple Tableau Viz plugin for WordPress, authored by Gary Hukkeri, in all releases up to and including version 2.0. No other vendors or products are impacted.

The CVSS score of 6.4 indicates a medium impact, while the EPSS score of less than 1% shows a very low probability of exploitation. The flaw is limited to authenticated contributors, meaning an attacker must first gain at least contributor rights to inject the malicious shortcode. Once injected, the script executes for every visitor to the affected page. The vulnerability is not listed in the CISA KEV catalog, reducing the likelihood of widespread active exploitation.