The DPEPress plugin for WordPress, versions up to 0.3, allows authenticated users with contributor-level or higher rights to submit content that is inserted into the plugin’s ’dpe’ shortcode without proper sanitization or escaping. The input fields for shortcode attributes can thus contain arbitrary JavaScript, which is stored in the database and rendered when any site visitor loads a page containing the shortcode. This stored cross‑site scripting (CWE‑79) can lead to session hijacking, cookie theft, or defacement of the site. The vulnerability is limited to users who can create or edit content with the plugin and does not depend on an untrusted external request.

The affected product is the DPEPress WordPress plugin by darkyudex, specifically all releases through 0.3. Any WordPress site that has this plugin installed and whose moderator or contributor users can add the ’dpe’ shortcode is at risk.

The CVSS base score of 6.4 indicates a medium severity. The EPSS score is less than 1%, implying a very low likelihood of exploitation at the time of this analysis, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with contributor or higher privileges, and then any site visitor will execute the injected script. While the attack vector is internal (authenticated role), the resulting script runs in the context of any visitor’s browser, potentially compromising their credentials or defacing content.