The WOW Entrance Effects (WEE!) WordPress plugin contains a stored cross‑site scripting flaw. A contributor‑level or higher authenticated user can inject arbitrary JavaScript through the plugin’s ‘wee’ shortcode by supplying malicious attributes that are neither sanitized nor escaped. The injected scripts run under the context of any visitor who loads the affected page, enabling credential theft, defacement, or further exploitation of the site. This vulnerability is solely exploitable by authenticated users with contributor permissions or higher, and requires that the attacker be able to add or modify content that contains the shortcode.

The flaw exists in all releases of WOW Entrance Effects (WEE!) up to and including version 0.1, distributed by the vendor darkosxrc. WordPress sites that have installed this plugin and have at least contributor‑level accounts are affected.

With a CVSS score of 6.4 the vulnerability is of moderate severity. The EPSS score is below 1 %, suggesting that exploit activity has historically been rare, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, once an account with contributor or higher privileges is compromised, an attacker can inject persistent scripts that execute whenever a page containing the shortcode is viewed. The attack vector is authenticated via normal WordPress usage, leveraging the plugin’s shortcode processing.