The Posts per Cat plugin is vulnerable to stored cross‑site scripting because user‑supplied attributes for the 'ppc' shortcode are neither sanitized nor escaped when saved. A malicious contributor or higher‑level user can embed arbitrary JavaScript that will execute for any visitor who views a page containing the affected shortcode. This can lead to session hijacking, theft of credentials, defacement, or other malicious actions performed under the victim’s user context.

The vulnerability exists in all releases of the Posts per Cat plugin up to and including version 1.4.2, which is distributed for WordPress sites. The plugin is managed under the vendor urkekg. Sites that have these versions installed with contributor–level or higher users are at risk.

The CVSS score of 6.4 indicates a moderate severity attack that requires authenticated access. The EPSS score of less than 1% suggests low current exploit probability, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers would need to operate from a contributor or higher account and inject malicious content via the shortcode attributes. Once injected, the script executes in the context of any site visitor, providing potential for widespread compromise of user sessions and data.