The vulnerability stems from the Curved Text plugin's failure to sanitize the 'radius' parameter of the arctext shortcode. Authenticated users with Contributor-level privileges or higher can supply malicious input that is saved and later rendered on any page using the shortcode. This allows an attacker to inject and execute arbitrary JavaScript whenever visitors view the page, compromising data confidentiality and the integrity of web content.

Soniz’s Curved Text plugin for WordPress, versions up to and including 0.1, is affected. The issue exists in all releases where the 'radius' attribute is processed without proper escaping.

The CVSS score of 6.4 indicates moderate risk, while the EPSS score of less than 1% signals that real‑world exploitation is currently unlikely. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Its exploitation requires a user with Contributor-level access, so the attack surface is limited to sites that grant many contributors write permissions. Nonetheless, any successful exploitation would allow the attacker to run arbitrary code in the browsers of all visitors to affected pages.