The OpenID Connect Generic Client plugin contains a stored XSS flaw in its openid_connect_generic_auth_url shortcode. When the shortcode is invoked, user‑supplied data is rendered without proper sanitization or escaping. An authenticated user with Contributor access or higher can embed arbitrary JavaScript that will run in the browser of any visitor who loads a page containing the shortcode, potentially allowing data theft or session hijacking. This vulnerability is a classic input‑validation error, identified as CWE‑79.

The flaw exists in all versions of the plugin through 3.10.0, published by daggerhart for WordPress. Sites running a vulnerable version of the OpenID Connect Generic Client that expose the shortcode to Contributor or higher roles are at risk. The issue does not affect the core WordPress installation itself, but rather the plugin’s handling of shortcode content.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% shows a low probability of being actively exploited at the time of this analysis, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated user with Contributor or higher privileges; once the script is injected, it runs automatically for any visitor to the affected page, enabling client‑side attacks.