The vulnerability resides in the Custom Frames WordPress plugin where the 'class' attribute of the 'customframe' shortcode is not properly sanitized or escaped. An attacker with Contributor‑level or higher privileges can store malicious scripts that will run whenever a user accesses a page containing the injected shortcode. This can lead to defacement, credential theft and session hijack. The weakness is a classic Stored Cross‑Site Scripting flaw categorized as CWE‑79.

The affected product is Custom Frames from blakelong, versions up to and including 1.0.1. Sites using any earlier release of this plugin are also vulnerable.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1 % reflects a very low probability of current exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw requires authenticated contributor access, exploitation requires the attacker to possess Contributor or higher role on the target WordPress installation. If that requirement is satisfied, the attacker can inject a stored script that will execute for all users who view the affected page.