The Author Bio Shortcode plugin suffers from improper neutralization of user input during page generation, allowing malicious JavaScript to be stored in the author bio field and executed every time the bio is rendered. This stored Cross‑Site Scripting can be used to inject scripts that run in visitors' browsers, potentially enabling defacement, phishing, or other client‑side attacks. The description does not enumerate specific attacker outcomes, so the impact is limited to the execution of injected scripts within the context of the site."

WordPress sites that use Philip John’s Author Bio Shortcode plugin in versions up through 2.5.3 are affected. Sites where author metadata are editable by users and the plugin is active are at risk of exploitation."

The CVSS score of 6.5 indicates medium severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to edit or create author bio content, which is commonly granted to non‑administrator roles in WordPress installations. Based on the description, this requirement is inferred from the need to introduce malicious input into the bio field."