The CC‑IMG‑Shortcode plugin stores user‑supplied attributes of its Shortcode without proper sanitization, enabling a stored cross‑site scripting attack. An authenticated user with contributor privilege can inject arbitrary JavaScript into the shortcode’s attributes. When a page containing the shortcode is rendered, the script executes in every visitor’s browser, potentially defacing content or stealing session data.

ClearcodeHQ’s CC‑IMG‑Shortcode WordPress plugin. All releases up to and including version 1.1.0 are affected. Users should inspect their installations for the presence of these versions and plan an upgrade when a fix becomes available.

The CVSS score of 6.4 indicates moderate severity, while an EPSS of less than 1% suggests a low probability of exploitation. The vulnerability requires authenticated access at contributor level or higher; once compromised, the stored script runs for any user who views the affected page. As it is not listed in the CISA KEV catalog, it is considered a non‑known‑exploited vulnerability. The likely attack vector is inferred to be the plugin’s shortcode editor, where contributors can embed malicious attributes.