The Mstoic Shortcodes plugin for WordPress suffers from a stored cross‑site scripting flaw in the 'start' parameter of the ms_youtube_embeds shortcode. This weakness allows attackers who have Contributor‑level or higher access to embed arbitrary JavaScript that is persisted and executed when any user views the affected page. When executed, the malicious code can steal session cookies, hijack a logged‑in user’s session, or perform further attacks against site visitors.

Mstoic Shortcodes plugin for WordPress, versions up through 2.0 inclusive. The vulnerability exists in all releases up to and including 2.0, so any WordPress site running that plugin version is affected. Administrators should verify the plugin version and upgrade when a newer, fixed release is available.

The CVSS score of 6.4 places this vulnerability in the medium severity range. The EPSS score of <1% indicates a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, because the flaw is stored and requires only authenticated Contributor+ access to inject code, it can affect all site visitors when the compromised content is displayed, making timely patching still advisable.