SpendeOnline.org, a WordPress plugin, has a stored cross‑site scripting flaw that allows authenticated users with contributor‑level or higher access to inject arbitrary JavaScript via the plugin's 'spendeonline' shortcode. Because the plugin fails to properly sanitize or escape user‑supplied shortcode attributes, the injected script is persisted and executed whenever the affected page is loaded by any visitor. The flaw permits defacement, credential theft, or the delivery of malicious payloads to other users, thereby compromising confidentiality, integrity, and availability of the site.

The vulnerability applies to the SpendeOnline.org plugin distributed by dr‑thomas‑fuessl and affects all releases up to and including version 3.0.1. No other vendors or product lines are impacted.

The CVSS score of 6.4 indicates moderate severity, while an EPSS score below 1 percent suggests a very low but non‑zero probability of exploitation in the wild. Because the flaw requires only contributor‑level or higher authentication, an attacker who has already compromised or obtained legitimate privileges can easily exercise the vulnerability, especially on sites with a large contributor base. The plugin is not listed in the CISA KEV catalog, but the stored script execution could enable persistent attacks that are difficult to detect until the malicious page is visited.