The Animated Buttons WordPress plugin allows authenticated contributors or higher to add a shortcode that accepts arbitrary user supplied attributes. Because the plugin fails to sanitize these attributes and escape the resulting output, any injected script will be stored and executed whenever a page containing the shortcode is loaded, effectively granting the attacker the ability to run arbitrary Javascript in the browsers of all visitors to that page.

WordPress sites that have the Animated Buttons plugin installed, in any version up to and including 1.0.0. The vulnerability applies to any environment where the site administrator has granted Contributor or higher role permissions to users, as only such users can create or edit content with the plugin's shortcode.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation of this flaw is currently not widespread, and it is not listed in the CISA KEV catalog. Nevertheless, an attacker who has Contributor or higher access can persistently inject malicious scripts that will run in the browsers of all visitors on affected pages. The necessary conditions—having contributor privileges and adding a page or post with the auto‑downloader shortcode—are relatively low barriers for site administrators or malicious insiders. Once injected, the script can read cookies, hijack sessions, or perform other client‑side attacks on unsuspecting users.