The SortTable Post WordPress plugin is vulnerable to a stored cross‑site scripting flaw that allows attacker‑supplied data to be stored in the plugin’s shortcode attributes without proper sanitization or escaping. The flaw resides in the 'id' parameter of the shortcode, meaning that scripts can be persisted and later delivered to other users when the affected page is rendered and interacted with via mouse events. This leads to a disruption of confidentiality and integrity of the site, enabling attackers to execute arbitrary JavaScript in the context of legitimate visitors.

The vulnerable product is the SortTable Post plugin distributed by sscovil for WordPress. All released versions up to and including 4.2 contain the flaw; any site using these releases is impacted.

With a CVSS score of 6.4 the vulnerability is of moderate severity, and its EPSS score is less than 1%, indicating a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The vulnerability requires that the attacker be an authenticated contributor or higher with permissions to create or edit content. When these prerequisites are met, the attacker can inject scripts that will execute for any user who views the abused page and interacts with it.