The Viitor Button Shortcodes plugin is vulnerable to stored cross‑site scripting via the 'link' shortcode attribute. Supplying a malicious value in this attribute allows an authenticated attacker with Contributor or higher privileges to inject arbitrary JavaScript into pages. When the affected page is viewed, the injected script executes in the context of the site, enabling actions such as cookie theft, session hijacking, or defacement.

The vulnerability affects all releases of Viitor Button Shortcodes up to and including version 3.0.0. The product is distributed by ViitorcloudVC and is commonly used on WordPress sites that allow contributors to create or edit content.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% suggests that the likelihood of exploitation observed in the wild is low, and the vulnerability is not listed in CISA KEV. However, exploitation requires at least Contributor‑level access, which is common on many sites. An attacker who can add or edit posts can exploit the flaw to inject scripts that run for all users who visit the compromised page, potentially leading to widespread compromise.