The IRM Newsroom plugin allows stored XSS by executing arbitrary scripts within the 'irmeventlist' shortcode. An authenticated user with contributor privileges can supply unsanitized attributes, causing the plugin to render malicious code in any page that contains the shortcode. This vulnerability permits an attacker to run malicious scripts in the browsers of other site visitors, potentially stealing cookies, defacing pages, or hijacking user sessions.

This issue affects the WordPress plugin IRM Newsroom from irmau, in all released versions up to and including 1.2.19. The affected environments are WordPress installations that have the plugin installed and allow contributors to add or edit content containing the shortcodes.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% suggests a very low exploitation probability at present, and the CVE is not listed in CISA’s KEV catalog. Attacks require the attacker to be authenticated and have contributor level access to insert the malicious shortcode, after which the script will execute for all users who view the injected page. Because the vulnerability is stored, there is no need for phishing or other pre‑conditions beyond normal content editing.