The EG‑Series WordPress plugin contains a stored cross‑site scripting flaw in its [series] shortcode. The shortcode accepts a "titletag" attribute that is not properly sanitized or escaped. An attacker who can authenticate with contributor‑level access or higher can embed arbitrary JavaScript into that attribute. When a page containing the injected shortcode is viewed, the malicious script executes in the victim’s browser context.

Any WordPress site running the EG‑Series plugin version 2.1.1 or earlier is vulnerable, provided the Classic Editor plugin is active. The Classic Editor allows contributors to add or edit content, so sites where contributors have page‑editing rights and the Classic Editor is enabled are at risk. The vulnerability is specific to the EG‑Series product by emmanuelg.

The CVSS score of 6.4 indicates a medium severity vulnerability. The EPSS score of less than 1% suggests a low probability of exploitation in the short term. Attackers must first authenticate to the WordPress site with at least contributor privileges; the flaw is not remotely exploitable without authentication. The issue is not listed in the CISA KEV catalog, so it is not known to be actively exploited in the wild. Overall risk is moderate, contingent on the presence of a compromised contributor account and the Classic Editor plugin.