The WZ Followed Posts – Display what visitors are reading plugin for WordPress contains an insufficient sanitization flaw that allows attackers who possess contributor or higher access to store malicious JavaScript in a page through the plugin's 'wfp' shortcode. When another user views that page, the injected code is executed within the victim's browser, potentially stealing session cookies, defacing content or performing other credential‑seizing actions. The flaw is a classic example of CWE‑79 Cross‑Site Scripting.

All releases of the WordPress plugin WZ Followed Posts – Display what visitors are reading up to and including version 3.1.0 are affected. The vulnerability resides in the plugin code and is not limited to a specific WordPress theme or configuration.

The CVSS score of 6.4 labels the flaw as moderate, and the EPSS score of < 1% indicates a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated Contributor+ access, which is typically available to users who can add or edit content. Once the attacker injects the malicious shortcode, the script will execute for every user who loads the affected page, and the attack remains persistent until the content is removed or the plugin is updated.