The CSS3 Buttons plugin processes a "button" shortcode that accepts arbitrary attributes. Because the plugin does not sufficiently sanitize user input or escape output, an authenticated user with contributor or higher privileges can embed malicious JavaScript in the shortcode attributes. When a victim views the affected page, the injected scripts run in the victim’s browser, providing an attacker a vector for cookie theft, defacement, or credential hijacking. This weakness is a classic Stored Cross‑Site Scripting flaw, classified as CWE‑79.

Any WordPress site that has the CSS3 Buttons plugin installed, for all releases up to and including version 0.1. A user must have contributor or higher role to inject the malicious payload, while any visitor to the page containing the vulnerable shortcode may be affected.

With a CVSS score of 6.4, the vulnerability is considered medium severity. The EPSS score of less than 1% indicates that the attack likelihood is low, and the issue is not listed in the CISA KEV catalog. The required authentication means an attacker must first gain login credentials or elevate permissions, but once an exploit is used, the malicious code is stored and will propagate to all visitors of the affected page.