The Shouty plugin for WordPress is vulnerable to stored cross‑site scripting by way of the shortcode’s attributes. Because the plugin fails to sanitize or escape user‑supplied attributes, an attacker with contributor-level or higher access can inject arbitrary JavaScript that is stored in the site content and executed whenever a page containing the shortcode is viewed. This CWE‑79 flaw allows the attacker to acquire session information, deface the site, or redirect users to malicious destinations.

WordPress installations that have the Shouty plugin version 0.2.1 or earlier. Any site using the shortcodes from this plugin is affected, regardless of the overall WordPress version.

With a CVSS score of 6.4 the vulnerability presents moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access at the contributor level or higher, and the attacker must insert malicious data via the shortcode. Once injected, the stored script runs for all users who view the affected page, potentially compromising user sessions or data.