The ShMapper by Teplitsa WordPress plugin contains a stored cross‑site scripting (XSS) flaw caused by improper neutralization of input during web page generation. Input provided through the plugin can be persisted in the database and later rendered to any site visitor, allowing the execution of arbitrary JavaScript within that visitor’s browser. This can lead to session hijacking, data theft, or site defacement. The flaw is classified as CWE‑79.

All installations of the ShMapper by Teplitsa plugin with version numbers up through and including 1.5.0 are vulnerable. The responsible vendor is Denis Cherniatev.

The CVSS score of 5.9 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation likely requires the ability to submit or modify content via the plugin’s input fields, which are then stored and rendered to site visitors. The description does not specify the exact privilege level required, so it is uncertain whether an attacker needs administrative, editorial, or lower‑level WordPress access to exploit the flaw, but the vulnerability itself benefits anyone who can read the affected content.