The WPGancio plugin for WordPress allows authenticated users with contributor-level access or higher to inject arbitrary scripts through the ‘gancio-event’ shortcode attributes. Because user‑supplied attributes are not properly sanitized and output is not escaped, the injected code is stored and executed whenever a page containing the shortcode is viewed, potentially compromising site integrity and client browsers.

All installations of the WPGancio plugin version 1.12 or earlier running on WordPress sites are impacted. The vulnerability exists in the plugin’s shortcode handling code and affects any site that has loaded or created a page with the vulnerable ‘gancio-event’ shortcode.

The CVSS score of 6.4 indicates a medium‑severity vulnerability. The EPSS score is less than 1%, reflecting a very low probability of exploitation at the time of this analysis. The issue is not listed in the CISA KEV catalog, but authenticated users can exploit it by authoring or editing a page containing the shortcode, injecting malicious attributes that execute when the page is viewed by any user.