The Simple post listing plugin, in versions up to and including 0.2, fails to properly sanitize the "class_name" attribute in the short‑code it exposes. When a contributor or higher level user supplies malicious content through this parameter, the value is stored and later rendered without escaping. Consequently, attackers can place arbitrary JavaScript that executes in the browsers of any user who views a page containing the affected shortcode. This weakness (CWE‑79) allows an authenticated attacker with contributor privileges to hijack sessions, deface pages, or harvest credentials by exploiting unsuspecting visitors.

WordPress sites using the "Simple post listing" plugin (sgcoskey) with any version 0.2 or earlier are affected. The vulnerability is exploitable only when the attacker has at least contributor permissions and does not demand remote code execution or system compromise.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1% suggests currently low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, further indicating limited or no reported exploitation. An attacker would need to authenticate and use the contributor role to insert malicious code via the shortcode; the threat is limited to cross‑site scripting rather than server‑side compromise.