The WP‑Thumbnail plugin allows a contributor‑level user to insert arbitrary web scripts through the unfiltered 'roboshot' shortcode. The created scripts are stored with the page content and will run whenever any visitor loads the page. The flaw originates from insufficient input sanitization and output escaping on shortcode attributes, a classic input validation weakness (CWE‑79).

WordPress sites using the WP‑Thumbnail plugin from robocasters, version 1.1 or earlier. The flaw affects every installed instance of this plugin in those versions and can be triggered by any user with contributor or higher role.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is less than 1%, suggesting exploit attempts are scarce. The flaw is not listed in the CISA KEV catalog. An attacker with contributor‑level access can embed arbitrary JavaScript into pages, which will execute in the browsers of all users who view the vulnerable page. The attack vector is an authenticated web interface that accepts user input via shortcode attributes, and the impact can affect anyone visiting the vulnerable page.