The Electric Enquiries WordPress plugin allows authenticated users with Contributor level or higher to inject malicious JavaScript through the 'button' attribute of the electric‑enquiry shortcode. The input is stored without proper sanitization or escaping, so the injected script persists in the database and runs whenever a page containing the shortcode is rendered. This flaw enables client‑side compromise such as cookie theft, session hijacking, phishing, or defacement, and it affects the confidentiality, integrity, and availability of the website contents for all users who view the page. The weakness is a classic Stored XSS (CWE‑79).

All installations of the Electric Enquiries plugin version 1.1 and earlier. The plugin is distributed by Electric code and is a normal WordPress plugin, so any WordPress site that has the plugin activated and includes the electric‑enquiry shortcode is at risk. The vulnerability is limited to sites where users can access the plugin’s shortcode editor or configuration pages. Any WordPress instance using one of these affected plugin versions is impacted.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1% shows a low probability of exploitation. The vulnerability is not currently listed in CISA KEV. An authenticated attacker with Contributor or higher privileges can inject malicious scripts via the button attribute, which are stored and executed when a user visits a page containing the shortcode. The attack vector requires only standard WordPress authentication at Contributor level and does not involve remote code execution on the server.