The Responsive Progress Bar plugin for WordPress contains a stored cross‑site scripting flaw caused by insufficient input sanitization in its rprogress shortcode. When an authenticated contributor or higher user inserts malicious data into the shortcode’s attributes, the data is stored in the database and later rendered without proper escaping. As a result, any visitor to a page that uses the vulnerable shortcode will have arbitrary JavaScript executed in their browser.

WordPress sites running the Responsive Progress Bar plugin, version 1.0 or earlier, regardless of other plugins or themes. The flaw exists only in releases up to and including 1.0; later versions are not affected.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is below 1 %, suggesting a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a contributor‑level or higher authenticated account to inject the malicious payload. Once injected, the script executes in the browsers of any visitor to the affected page, providing the attacker with client‑side code execution on those users.