The Multiple Post Type Order WordPress plugin contains a vulnerability that allows an attacker with contributor‑level or higher access to inject arbitrary JavaScript through the plugin’s 'mpto' shortcode. The injected code is stored in the page content and executes automatically whenever any visitor loads that page, thereby enabling client‑side exploitation.

All releases of the Multiple Post Type Order plugin by josj404 with a version number of 1.10.0 or earlier are affected. The flaw manifests in any WordPress site that uses these versions and actively employs the 'mpto' shortcode in posts or pages.

The vulnerability is scored with a CVSS base of 6.4, indicating moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. It is not currently listed in the CISA KEV catalog. Exploitation requires an authenticated user with contributor or higher role who can edit content that includes the 'mpto' shortcode; once the malicious script is injected, it runs for all visitors to that page.