The Sermon Manager plugin for WordPress is vulnerable to Stored Cross‑Site Scripting via the sermon‑views shortcode in all versions up to 2.30.0. Unsanitized user‑supplied attributes allow an attacker to inject arbitrary scripts that will execute whenever a user views a page containing the injected shortcode, thereby compromising the user’s browser session or leaking data.

WordPress sites that install the wpforchurch Sermon Manager plugin version 2.30.0 or earlier are affected. The vulnerability is limited to sites that have the plugin enabled and have users with Contributor or higher level access.

The CVSS score of 6.4 indicates moderate severity, but the EPSS score of less than 1 % suggests a very low likelihood of active exploitation in the wild. The flaw is not listed in CISA’s KEV catalog, further indicating limited public exploitation. Attackers must first authenticate as a Contributor or above to add or edit the sermon‑views shortcode, then craft a payload that becomes stored and later executed in any user’s browser. Based on the description, it is inferred that no privilege escalation beyond the user’s existing role is required, but the impact is in the integrity and confidentiality of all site visitors’ browsers.