The vulnerability stems from improper neutralization of user input during page rendering, allowing a stored XSS payload with the plugin’s shortcodes. Based on the description, it is inferred that an attacker could embed malicious JavaScript that runs in the context of any site visitor, potentially enabling credential theft, session data access, or other client‑side attacks. The flaw is a classic stored XSS (CWE‑79).

The weakness affects WordPress sites that have the Show/Hide Shortcode plugin by Lars Wallenborn installed in version 1.0.0 or earlier. Any site using these versions is exposed. No later versions or other products are listed as affected.

The CVSS score of 6.5 rates it as moderate severity; the EPSS score of less than 1 % indicates a low probability of current exploitation, and the flaw is not listed in the CISA KEV catalog. Based on the description, the vulnerability requires an attacker to create a malicious shortcode that is stored by the plugin and later rendered for visitors, allowing the payload to be executed multiple times. This could affect all users who view the impacted content. The likely attack vector is inferred to be the plugin’s shortcode input interface, which is accessible to any role that can create or edit content using that plugin.