The ST Categories Widget plugin for WordPress contains a stored cross‑site scripting vulnerability in its st‑categories shortcode. The flaw arises from insufficient sanitization of the shortcode’s attributes and a lack of output escaping, which allows an authenticated contributor or higher to inject JavaScript that becomes stored on the site. Once stored, the malicious payload will execute whenever any visitor loads a page containing the shortcode, potentially exposing sensitive data or enabling unauthorized actions. Based on the description, it is inferred that the injected scripts could perform client‑side attacks such as cookie theft, session hijacking, or page defacement, but these specific impacts are not explicitly stated in the advisory.

This issue affects any WordPress website that has the beautifultemplates ST Categories Widget plugin installed in version 1.0.0 or earlier. The plugin is available in the WordPress plugin repository and is identified by the vendor name beautifultemplates. All releases up to and including 1.0.0 are vulnerable.

The CVSS score of 6.4 classifies the flaw as moderately high severity, while the EPSS score of less than 1% indicates a low but present probability of exploitation. Because the attack merely requires contributor‑level authentication, a wide range of site users may be able to inject malicious code. The vulnerability is currently not listed in the CISA KEV catalog, suggesting no publicly documented zero‑day exploitation has been seen.