The Nautic Pages plugin for WordPress introduces a stored cross‑site scripting flaw through its np_marinetraffic_map shortcode. Because attributes supplied to the shortcode are neither sanitized nor escaped, whatever content an authenticated contributor supplies becomes stored in the page database. When a user views a page that contains the shortcode, the stored malicious script executes in the visitor’s browser under the user’s session context. The primary impact is the ability for a contributor or higher‑privileged user to inject script code that runs whenever any visitor accesses the compromised page. Based on the nature of stored XSS, it is inferred that the injected scripts could be used to attempt phishing or hijack sessions, though such downstream effects are not explicitly detailed in the advisory.

All installations of the Nautic Pages plugin for WordPress up to and including version 2.0 are affected. No specific patch versions are listed in the advisory; the vulnerability exists in every release up to the 2.0 series.

The vulnerability carries a CVSS score of 6.4, reflecting moderate severity, and an EPSS score of less than 1 %, indicating a low likelihood of widespread exploitation at present. The flaw is not listed in the CISA KEV catalog. The exploit requires an authenticated account with contributor or higher privileges to add or edit page content that includes the vulnerable shortcode. A successful attack path involves injecting malicious script through the shortcode attributes, storing it, and then having any user view the affected page to trigger the payload.