The Ultra Skype Button plugin for WordPress has a stored XSS vulnerability that allows authenticated users with Contributor-level permissions to inject arbitrary scripts via the btn_id parameter of the [ultra_skype] shortcode. Unsanitized input is neither validated nor properly escaped before being persisted, so the malicious payload is stored in the database and executed whenever visitors load affected pages, potentially hijacking sessions, stealing credentials or defacing content.

WordPress sites running the Ultra Skype Button plugin by sozan45, versions 1.0 and earlier. Any installations that include the plugin and the [ultra_skype] shortcode are vulnerable; all affected sites should be inspected for the plugin and its usage.

The CVSS score of 6.4 classifies this issue as medium severity, and the EPSS value of less than 1% indicates a low probability of real‑world exploitation. Although the vulnerability is not listed in CISA’s KEV catalog, it remains a non‑trivial risk for sites that grant Contributor or higher access to untrusted users. Attackers who can inject the script gain the ability to run code in the context of visitors, enabling credential theft, defacement, or further compromise of the site. Therefore prompt mitigation is recommended.