The Divelogs Widget plugin allows a stored cross‑site scripting flaw that is triggered via the latestdive shortcode. Unsanitized and unescaped user‑supplied attributes let an attacker insert arbitrary JavaScript, which will run automatically whenever a page containing the injected content is viewed. This can lead to session hijacking, credential theft, defacement, or the spread of malware to site visitors.

WordPress sites running the Divelogs Widget plugin by Klemmkeil, versions up to and including 1.5. Users with contributor‑level or higher access can exploit the flaw because it is triggered by content supplied by authenticated contributors.

The CVSS score of 6.4 indicates a moderate severity with potential for high impact to confidentiality and integrity if an attacker succeeds. The EPSS score is less than 1%, suggesting that the likelihood of exploitation in the near term is low, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, any site with contributors who potentially wish to inject malicious code can execute arbitrary scripts, making the vulnerability attractive to attackers. The attack vector is an authenticated user inserting malicious shortcode attributes into a post or page, which is then stored in the database and executed on every request to that page.