The vulnerability exists because input supplied in Genesis Style Shortcodes is not properly neutralized before being rendered, allowing an attacker to inject arbitrary JavaScript into the page. This DOM‑Based XSS flaw can be used to execute scripts in the context of the site’s users, potentially leading to session hijacking, credential theft, or defacement of the web page. The weakness is identified as CWE‑79, a classic input validation error.

WordPress users running the Genesis Style Shortcodes plugin from any release up to and including 1.0 are affected. The plugin is developed by jtwerdy, and the issue spans all versions that lack the latest patch.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% suggests that exploitation is unlikely but still possible. The flaw is not listed in the CISA KEV catalog, so it has not yet been confirmed as a known exploited vulnerability. The likely attack vector involves an attacker placing malicious content through a shortcode that the plugin renders without proper escaping. Successful exploitation requires the compromised script to run in a user’s browser, which can be achieved by any visitor viewing a page containing the affected shortcode.