The Padlet Shortcode plugin for WordPress suffers from a Stored Cross‑Site Scripting flaw that can only be exploited by users who are already authenticated with contributor-level permissions or higher. The vulnerability arises through the 'key' attribute of the 'wallwisher' shortcode because the input is neither properly sanitized nor escaped before being stored. By injecting arbitrary JavaScript into this attribute, an attacker can cause malicious scripts to run whenever any authenticated or unauthenticated user opens a page containing the compromised shortcode. This can lead to session hijacking, defacement, or distribution of malware. The weakness is a classic injection flaw classified as CWE‑79.

Coffeebite’s Padlet Shortcode plugin for WordPress. All plugin releases up to and including version 1.3 are affected; no other vendors or product variants are listed.

The CVSS score of 6.4 places the vulnerability in the medium‑severity range. The EPSS score is reported as < 1%, indicating a very low likelihood that this exploit is actively used in the wild at present. The failure to appear in the CISA KEV catalogue further suggests limited exploitation. However, because the attack requires authenticated contributor access, any site that permits contributors to add or edit shortcodes is vulnerable. An attacker would need to create or edit a shortcode that includes a malicious 'key' value; the injected script is then stored and rendered when the shortcode is processed by WordPress when the page is accessed. If the site’s user base is large or heavily relies on contributors, the impact could be significant.