The Filestack plugin for WordPress is vulnerable to stored cross‑site scripting through the 'filepicker' shortcode. Unescaped attributes supplied by authenticated users with contributor or higher roles can be stored and later rendered as part of page content, allowing an attacker to inject arbitrary JavaScript that runs in the browsers of any visitor that loads the affected page. This flaw arises from insufficient input sanitization and output escaping and is classified as CWE‑79.

WordPress sites using the Filestack plugin version 2.0.8 or earlier are affected. Any installations that have the 'filepicker' shortcode enabled and permit contributor‑level users to insert content are at risk. The plugin vendor is shanaver, and the vulnerability has been observed in all releases up to and including 2.0.8.

The CVSS score is 6.4, indicating a medium severity risk. The EPSS score is less than 1%, suggesting that exploitation is relatively rare but still possible. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access, specifically contributors or higher, and involves inserting malicious attributes into the shortcode which are then stored and rendered. If successful, the injected script will execute when any site visitor views the affected page, potentially compromising their credentials, defacing content, or facilitating broader attacks. Based on the description, it is inferred that the attack vector is authenticated.