The Zenost Shortcodes plugin for WordPress contains a stored XSS flaw in the button shortcode that uses the link and target attributes. Because the plugin fails to sanitize or escape these inputs, an attacker who can create or edit content with Contributor‑level or higher privileges can inject arbitrary JavaScript that is stored within a page. When any user visits the affected page, the injected script runs in that user’s browser, potentially exposing session cookies, defacing content, or redirecting traffic.

All users of Zenost Shortcodes version 1.0 or earlier are affected. The vulnerability is present across all WordPress installations that have the plugin installed at the specified version.

The CVSS score of 6.4 categorises the vulnerability as moderate severity, while an EPSS score of < 1% indicates a low yet non‑zero likelihood of exploitation. The issue is not listed in the CISA KEV catalog. Exploitation requires authenticated access with Contributor or higher privileges and involves the user creating or editing a post that contains an injected button shortcode. Once stored, the malicious code executes for every visitor to the affected page.