The vulnerability arises from improper neutralization of user input when generating web pages, allowing attackers to inject malicious scripts that are executed in a victim’s browser. This can lead to theft of session cookies, credential guessing, defacement, or the execution of arbitrary code in the user’s context. The weakness is a classic CWE‑79 Cross‑Site Scripting flaw where untrusted input is reflected back without adequate sanitization.

The affected vendor is hccoder, specifically the WordPress Better User Shortcodes plugin, versions from the earliest (n/a) up to and including version 1.0. WordPress sites that have installed this plugin and use its shortcodes are at risk, regardless of the hosting environment or underlying operating system.

The CVSS score of 7.1 indicates high impact, while the EPSS score of less than 1% suggests low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely exploit the issue by crafting a malicious URL or input that includes the vulnerable shortcode, a typical web‑based reflected XSS attack vector. Successful exploitation would be limited to the victim’s browser and does not require elevated privileges on the web server.