The Ungapped Widgets plugin for WordPress can store arbitrary JavaScript when an authenticated user with contributor or higher privileges supplies a malicious value in the prefillvalues attribute of the ungapped‑form shortcode. Because the input is neither sanitized nor escaped, the injected script is persisted in the database and executed in the browsers of anyone who views a page containing the shortcode. The flaw is a classic client‑side code injection, classified as CWE‑79.

Any WordPress site that has the Ungapped Widgets plugin version 1 or earlier is vulnerable. An attacker must be logged in as a contributor or higher to insert a malicious shortcode; normal site visitors are not required to be authenticated. The risk is limited to pages that render the ungapped‑form shortcode; the core WordPress installation itself is not affected.

The CVSS score of 6.4 categorizes the vulnerability as medium severity. The EPSS score of less than 1% indicates a low probability of widespread exploitation at present, and the issue is not listed in the CISA KEV catalog. Successful exploitation requires the attacker to have editing rights and to supply the malicious shortcode. Once a victim views the affected page, the script runs under their browser context. Based on the description, it is inferred that the attacker could potentially steal credentials, deface content, or carry out additional malicious actions.