The IRM Newsroom plugin for WordPress stores attributes supplied to its 'irmflat' shortcode without sanitization or escaping. When a contributor or higher-level user inserts or edits a post containing the shortcode, those attributes are saved in the database and rendered on any page that includes the shortcode. The unsanitized content is subsequently executed by a visitor’s browser, allowing the attacker to run arbitrary JavaScript. This grants an attacker the ability to affect the visual or functional integrity of the site from the perspective of any user who views the injected page, without providing direct code‑execution on the server.

Any WordPress site that has the IRM Newsroom plugin from irmau, version 1.2.19 or earlier, is affected. Sites that allow users with contributor or higher privileges to edit or publish content including the 'irmflat' shortcode are at risk.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1 % suggests a low probability of widespread exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a WordPress user account with contributor-level permissions or higher and the ability to insert or edit content that includes the vulnerable shortcode. Once a payload is stored, it is delivered to all visitors of the affected page.