The Precise Columns WordPress plugin is vulnerable to stored cross-site scripting due to the lack of sanitization on the wrap_id shortcode attribute in all releases up to version 1.0. When an authenticated attacker with contributor-level or higher access inserts a malicious wrap_id value, the plugin embeds it directly into the generated HTML output. This allows the attacker to inject arbitrary JavaScript that executes whenever any site visitor loads the affected page, potentially enabling credential theft, defacement, or further exploitation within the site.

All installations of the Precise Columns plugin developed by simonpedge, with any version numbered 1.0 or older, are affected. Sites that have the plugin activated and include the wrap_id attribute in posts or pages, and that grant contributor or higher roles to attackers, can be exploited.

The vulnerability has a CVSS score of 6.4, indicating a moderate severity. The EPSS score is below 1 %, suggesting a low probability of public exploitation at present, and it is not listed in the CISA KEV catalog. Nevertheless, because the flaw requires only an authenticated contributor or higher account, many WordPress sites are likely at risk. Successful exploitation would grant an attacker the ability to run arbitrary scripts in the browsers of site visitors, leading to possible session hijacking, data exfiltration, or further lateral movement within the environment.