The WP Dropzone plugin for WordPress allows authenticated users with Contributor or higher permissions to embed a "callback" attribute in shortcode tags. The plugin fails to sanitize or escape the value of this attribute before evaluating it via JavaScript’s `new Function()` constructor. Because the value is persisted in the database, every subsequent page view that includes the shortcode executes the attacker‑supplied JavaScript. The stored XSS flaw can be used to steal session cookies, deface content, or deliver other client‑side attacks when any user visits the affected page.

All installations of the WP Dropzone plugin from its initial release up to and including version 1.1.1 are vulnerable. The plugin is distributed by nazsabuz and operates within WordPress sites that permit Contributors or higher to edit content. Updating the plugin to a release newer than 1.1.1 removes the flaw, or disabling the "callback" attribute entirely resolves the risk.

The CVSS score of 6.4 indicates medium severity, and the EPSS score of less than 1 % suggests a low probability of widespread exploitation at the present time. The vulnerability is not listed in CISA’s KEV catalog, which further implies limited known exploitation. Attackers must first gain authenticated Contributor‑level access, then insert a malicious callback value into a post or page using the shortcode. Once stored, the payload is executed whenever a visitor loads the affected content, making the exploitation straightforward once the initial privilege is achieved.