The Pollcaster Shortcode Plugin is vulnerable to stored cross‑site scripting because the height attribute of the pollcaster shortcode is not properly sanitized or escaped. A contributor‑level or higher authenticated user can submit a value containing malicious JavaScript, which is then stored in the database and rendered whenever a page containing the shortcode is viewed. This flaw allows an attacker to inject arbitrary scripts that will run in the browsers of anyone who visits the affected page, potentially enabling credential theft, cookie hijacking or other client‑side attacks.

All users running qzzr:Pollcaster Shortcode Plugin version 1.0 or earlier are affected. No specific WordPress version is mentioned, so the risk applies to any site that has installed the plugin at or below version 1.0.

The vulnerability has a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1 %, suggesting it is unlikely to be widely exploited at present. It is not listed in the CISA KEV catalog. Exploitation requires a user to be authenticated with contributor or higher privileges, after which the attacker can embed malicious code via the height attribute; the script executes in the context of all page viewers who load the shortcode.