The vulnerability is an improper neutralization of input during web page generation that enables DOM‑based XSS in the iografica IG Shortcodes plugin. Malicious input can execute arbitrary JavaScript in a victim’s browser, potentially leading to session hijacking, data theft, or phishing attacks. The flaw resides in the plugin’s handling of shortcode parameters.

Any WordPress site that has the iografica IG Shortcodes plugin installed with a version up to and including 3.1 is affected. The plugin is an add‑on for WordPress that allows users to embed Instagram shortcodes or similar content. Versions prior to 3.2 lack the necessary input sanitization.

With a CVSS score of 6.5, the vulnerability carries moderate severity. The EPSS score of <1% indicates a low probability of exploitation today, and the defect is not listed in the CISA KEV catalog. The likely attack vector is DOM‑based, typically via a crafted URL or form input that the plugin reflects without sanitization. An attacker does not need elevated privileges; any visitor can trigger the payload if they are directed to a vulnerable page.