The WP-Appbox plugin for WordPress is vulnerable to stored cross‑site scripting through its appbox shortcode. In all versions up to and including 4.5.4, insufficient input sanitization and output escaping allow an attacker with contributor‑level or higher access to inject arbitrary web scripts, which are executed whenever a user opens a page containing the malicious payload.

All installations of the WP‑Appbox plugin version 4.5.4 or earlier, distributed by marcelismus and available for WordPress sites.

With a CVSS score of 6.4, the vulnerability is considered moderate in severity. The EPSS score of less than 1% indicates a low likelihood of exploitation in the wild, and the vulnerability is not yet listed in the CISA KEV catalog. However, the attack requires authenticated access with contributor or higher permissions and manipulation of the shortcode attributes. Once injected, the stored script will run in the browsers of all users who view the affected page, potentially enabling session hijacking, data theft, or defacement.