The WPCS – WordPress Currency Switcher Professional plugin processes user input without proper validation before invoking WordPress’s do_shortcode function, allowing any supplied text to be executed as a shortcode. Because this check is performed for unauthenticated users, an attacker can supply arbitrary shortcode content to the site. The flaw provides direct executable shortcode capability.

This issue affects WordPress sites that have installed the realmag777 WPCS – WordPress Currency Switcher Professional plugin in any released version up to and including 1.2.0.4. The plugin is typically situated in the WordPress plugins directory and its shortcode handling is triggered during page rendering, widget updates, or other content processing.

The vulnerability is given a CVSS score of 7.3, indicating a moderate‑to‑high severity. The EPSS probability is reported as less than 1 %, suggesting that exploitation is currently uncommon but not ruled out. The issue is not listed in the CISA KEV catalog. An unauthenticated user can supply the malicious content from any public‑facing page or widget that accepts shortcode input, requiring no special privileges or pre‑conditions.