The Newpost Catch plugin accepts a custom npc shortcode for embedding content in WordPress posts. Because the plugin does not sanitize or escape user‑supplied attributes, an attacker who has contributor or higher privileges can store malicious scripts in the plugin's shortcode, causing stored XSS when a site visitor loads a page containing the injected content. This flaw, classified as CWE‑79, enables an attacker to execute arbitrary JavaScript on the client side, potentially leading to phishing, cookie theft or other malicious actions.

Affected by this flaw are installations of the Newpost Catch WordPress plugin from its author, with any version up to and including 1.3.19. Sites that use an older version of the plugin are vulnerable. The vulnerability is not present in versions newer than 1.3.19.

The CVSS score of 6.4 indicates moderate risk, while the EPSS of less than 1% signals a very low probability of current exploitation. The flaw requires authenticated access with at least contributor rights, so an attacker must first gain that level of access on the site. The vulnerability is not listed in the CISA KEV catalog, and there is no indication the vendor has released a patch. Therefore, while exploitation is technically feasible, the overall risk remains relatively low unless the site has compromised contributor privileges.