The List Attachments Shortcode plugin for WordPress contains a stored cross‑site scripting flaw that allows an authenticated user with Author role or higher to inject arbitrary scripts via the before_list parameter of the [list-attachments] shortcode. The injected payload is stored and subsequently executed whenever a user views a page containing the malicious shortcode, compromising the integrity of the site and potentially exposing user session information.

WordPress sites running the List Attachments Shortcode plugin version 0.4.1a or earlier. The vulnerability applies to all releases up to 0.4.1a, including older tags such as 0.4.1a and previous 0.4.x versions.

The CVSS score of 6.4 classifies this as a moderate‑severity issue. The EPSS estimate of less than 1% indicates a very low probability of exploitation at the time of analysis, and it is not listed in the CISA KEV catalog. Attackers must possess Author or higher privileges to insert or edit the shortcode; once the malicious code is stored, it affects all site visitors who load the affected page. The vulnerability arises from insufficient input sanitization and output escaping as documented in the plugin source code.