This vulnerability is a stored cross‑site scripting flaw caused by the Themify Shortcodes plugin not properly neutralizing user input when generating web pages. A malicious user can embed arbitrary HTML or JavaScript that is then rendered in other users’ browsers. Depending on the victim’s account privileges, an attacker could steal session cookies, perform phishing attacks, or unduly manipulate site content. The weakness is categorized as CWES-79 (Improper Neutralization of Input).

The issue affects the Themify Shortcodes plugin from older than version 2.1.4 down to and including 2.1.3. No modern releases beyond 2.1.3 have been identified as vulnerable. The plugin is provided by the vendor Themifyme.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of < 1% shows that exploitation chances are currently low. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector involves a user interacting with content that includes the vulnerable shortcode, or an attacker inserting malicious input into the shortcode via the WordPress admin interface. Exploitation requires the target’s browser to load the vulnerable page, which is typical for XSS attacks.