RevInsite, a WordPress plugin by krupenik, contains a stored Cross‑Site Scripting vulnerability through the token parameter in its shortcodes. The plugin fails to sanitize or escape the token value, allowing an authenticated user with Contributor or higher privileges to embed arbitrary JavaScript. When a victim visits a page containing the injected content, the script executes in the victim’s browser, enabling data theft, session hijacking, or defacement. The flaw is classified as CWE‑79.

The flaw affects all installations of RevInsite up to and including version 1.1.0. Any site running the plugin in those versions is at risk, regardless of WordPress core version, provided that contributors or higher‑privileged roles can delete or edit pages that include the vulnerable shortcode.

The vulnerability has a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1 %, suggesting a low likelihood of exploitation at this time. The flaw is not currently listed in CISA’s KEV catalog. Successful exploitation requires authentication with at least Contributor level; once achieved, the attacker can execute arbitrary JavaScript in the browsers of other site visitors. The risk is mitigated when the site restricts Contributor rights or disables the shortcode feature.