The FontAwesome.io ShortCodes plugin has a stored cross‑site scripting flaw that permits an attacker to inject malicious scripts into a WordPress site. The vulnerability is categorized as CWE‑79 and can be triggered through unsanitized user input that is persisted and later rendered in a web page. Exploitation could allow the attacker to execute arbitrary client‑side code in the victim’s browser, leading to credential theft, defacement, or further attacks, without requiring user interaction beyond initial exploitation of the plugin’s input interface.

The weakness exists in all releases of the FontAwesome.io ShortCodes plugin from the earliest version through 1.0. This includes installations that have not yet applied any updates or that are running the plugin at version 1.0 or earlier. Sites using this plugin should check the exact version in use and verify whether an upgrade path is available.

The CVSS score of 6.5 classifies the issue as moderate severity. The EPSS score of less than 1% indicates that the current probability of widespread exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to submit content that is stored by the plugin and rendered in future page loads. Once the script is executed in the victim’s browser, an attacker can perform typical XSS attacks. Due to the stored nature of the flaw, a single compromised user or malicious post can affect all visitors to the site.