The Entry Views plugin for WordPress allows a short‑code attribute to be supplied by authenticated users with contributor level or higher access. The plugin does not sanitize or escape these attributes, resulting in a stored cross‑site scripting vulnerability. An attacker therefore can insert JavaScript code that will persist in the database and run whenever a visitor loads the affected page. This could lead to cookie theft, session hijacking, defacement, or other malicious actions executed in the victim’s browser context.

WordPress installations that have the greenshady Entry Views plugin, version 1.0.0 or earlier, are affected. The flaw resides in the shortcode implementation within that plugin, regardless of the WordPress core version. Sites that have upgraded the plugin beyond 1.0.0 are not impacted by this specific issue.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of less than 1% suggests that the probability of exploitation is low at this time. The issue is not listed in the CISA KEV catalog. Nevertheless, the vulnerability can be leveraged from the WordPress administration interface; a contributor or higher user can add the malicious shortcode, and once injected the script will run for all users who view the page. Organizations that grant contributor access to untrusted individuals should consider this a higher risk scenario because the stored payload is invisible to casual review and can propagate widely across the site.