The CryptX plugin for WordPress allows users with contributor or higher privileges to insert content that includes a cryptx shortcode. Because the plugin fails to sanitize or escape the attributes supplied to that shortcode, attackers can embed arbitrary JavaScript into those attributes. When a visitor loads a page containing the malicious shortcode, the injected script executes in the visitor’s browser, enabling session hijacking, defacement, redirect to malicious sites, or other attacks that compromise the confidentiality, integrity, and availability of the site and its users.

All WordPress installations running the CryptX plugin in any version up to and including 4.0.5 are affected. The flaw resides in the cryptx shortcode handling and exists in every release before 4.0.6, so any site using those versions should perform an upgrade.

The CVSS score of 6.4 indicates moderate severity, while an EPSS score of less than 1% points to a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must be authenticated with contributor or higher privileges to inject a malicious shortcode, making authenticated social‑engineering the likely attack vector. Once the malicious attributes are stored, any user who views the affected page will have the script executed in their browser, providing a straightforward path for an attacker to compromise site users.