The Cool Tag Cloud plugin for WordPress suffers from a stored cross‑site scripting flaw caused by inadequate sanitisation of attributes passed to the plugin’s shortcode. Authenticated users with Contributor‑level or higher privileges can inject arbitrary JavaScript into pages that utilize the shortcode. When a user views the page, the injected script runs in the victim’s browser, potentially exfiltrating credentials, hijacking sessions, or defacing content. The weakness is a classic input validation problem (CWE‑79).

The vulnerability affects all releases of the Cool Tag Cloud plugin up to and including version 2.29. WordPress sites running those plugin versions and allowing contributors or higher‑level roles are impacted. No other products or versions are listed as affected.

The vulnerability scores a CVSS of 8.1, indicating high severity. The EPSS score is less than 1 %, suggesting a low probability of widespread automated exploitation but still possible in targeted attacks. The application is not listed in the CISA KEV catalogue, implying no known public exploitation at the time of analysis. An attacker requires authenticated access with Contributor or higher privileges, but once that threshold is met, they can inject code that will execute for any visitor to the affected page.