The vulnerability is a stored XSS that occurs when an authenticated user with contributor-level access submits the 'text' attribute of the jeba_forkit shortcode. Because the plugin fails to sanitize or escape user-supplied input, an attacker can store malicious JavaScript that will run in any browser that loads a page containing the shortcode. This enables session hijacking, defacement, or execution of arbitrary code in the context of the site.

The plug‑in Jeba Cute forkit version 1.0 (and all earlier releases) for WordPress is affected. The issue exists whenever the plugin is installed and the shortcode is used within posts or pages. No specific WordPress core versions are mentioned.

The vulnerability has a CVSS score of 6.4, indicating medium severity. The EPSS score is below 1 %, suggesting that exploitation is unlikely at present, and it is not listed in the CISA KEV catalog. An attacker would need authenticated contributor or higher privileges to inject the payload, meaning the attack surface is limited to users who can add or edit content. Once the malicious code is stored, it executes for every visitor who loads the affected page, providing the attacker with the same privileges as the visitor.