The IRM Newsroom plugin for WordPress is vulnerable to stored cross‑site scripting when an attacker with contributor‑level or higher access injects malicious script through the plugin’s ‘irmcalendarview’ shortcode. Because user provided attributes are not properly sanitized or escaped, the payload is stored in the database and executed whenever the impacted page is rendered. This flaw allows an attacker to execute arbitrary JavaScript in the context of any visitor to the injected page, potentially allowing credential theft, session hijacking, defacement or the execution of further malicious actions.

Affected systems include any website that uses the IRM Newsroom plugin for WordPress version 1.2.19 or older. The vulnerability is tied to the plugin itself, not the underlying WordPress core, and applies to all installations where the shortcode can be used by contributors or higher.

The CVSS score of 6.4 indicates a moderate impact, while the EPSS score is below 1 %, indicating a very low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, so there is no known active exploitation. An attacker must first be authenticated with contributor role or higher, after which they can inject the payload via the shortcode. Once injected, any user who accesses the affected page will have the stored script executed, forego the need for further exploit steps.