The Starboard Suite Reservation Calendars WordPress plugin contains a stored cross‑site scripting flaw that or higher privileges to inject arbitrary JavaScript into the [starboard‑suite‑lightbox] shortcode attributes. Because the plugin does not perform sufficient input sanitization or output escaping, the malicious script is written into the database and executed in the browsers of any the affected shortcode. This can lead to credential theft, defacement, session hijacking, or other client‑side attacksThe CVSS v3.2 score of 6.4 rates the vulnerability as moderate, while an EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Successful exploitation requires an authenticated account with Contributor or higher access, so the risk depends on the strength of credential controls, the distribution of Contributor accounts, and context of site visitors.

All WordPress sites that have the Starboard Suite Reservation Calendars plugin installed on version 3.1.4 or earlier are affected. Site administrators should verify which WordPress user roles are permitted to edit or insert shortcodes and audit existing content for any [starboard‑suite‑lightbox] usage.

The vulnerability carries a moderate CVSS v3.2 score of 6.4, indicating that exploitation can lead to significant client‑side impact but does not compromise server integrity. The EPSS score of < 1% suggests a low probability of active exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must first authenticate as a Contributor or higher user, a role that provides content‑creation privileges in WordPress. Once authenticated, they can insert malicious scripts into shortcode attributes that are stored in the database and executed when any visitor views the affected shortcode, resulting in potential credential theft, defacement, or session hijacking. The risk therefore depends on the availability of Contributor accounts, the strength of login controls, and the likelihood that site visitors will process the injected content.