The plugin’s ‘xls’ shortcode accepts user‑supplied attributes without proper sanitization or escaping, allowing an authenticated user with contributor privileges or higher to inject arbitrary JavaScript that will run whenever a page containing the shortcode is viewed. This stored XSS can be used for defacement, cookie theft, or further exploitation of the site’s users.

WordPress users running the Xavin's List Subpages plugin, any version up to and including 1.3. The vulnerability is present only for accounts that can add or edit content with contributor or higher privileges. No other plugin versions or other products are listed as affected.

The CVSS score of 6.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires an authenticated contributor or higher; thus the attack vector is inferred to be internal, via content creation or editing functions. Once injected, the malicious script executes in the context of any visitor, potentially enabling session hijacking or execution of additional payloads.