The WP-Recall – Registration, Profile, Commerce & More plugin is vulnerable to stored cross‑site scripting via the public‑form shortcode in all releases up to 16.26.10; insufficient sanitization of user‑supplied attributes lets an attacker embed arbitrary scripts that execute when a page with the shortcode is viewed. This flaw requires the attacker to be authenticated with a contributor‑level role or higher. Successful exploitation can lead to arbitrary client‑side code execution for users who view the affected page.

The vulnerability affects the WP-Recall – Registration, Profile, Commerce & More plugin for WordPress, specifically versions 16.26.10 and all earlier releases. The plugin is installed on WordPress sites that use the public‑form shortcode to generate registration, profile, or commerce forms.

The CVSS score of 6.4 indicates a medium severity level, and the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The issue is not listed in CISA's KEV catalog. The likely attack vector involves an authenticated contributor or higher leveraging the public‑form shortcode to inject malicious payloads into form attributes; the payload is stored and then delivered to any user who views the page containing the shortcode.