The 360 Photo Spheres plugin for WordPress contains a stored cross‑site scripting flaw that allows users with contributor‑level or higher permissions to inject arbitrary JavaScript into the content of the "sphere" shortcode. Because the plugin fails to properly sanitize or escape the attributes supplied by the attacker, the injected script is rendered and executed on any visitor’s browser when the page containing the shortcode is accessed.

The vulnerability affects the 360 Photo Spheres plugin by mrgoodfellow for all versions up to and including 1.3. WordPress sites that have installed or are using any of those affected versions are at risk when the plugin is used to create or edit posts or pages that contain the "sphere" shortcode.

The flaw has a CVSS score of 6.4, indicating medium severity, and an EPSS score of less than 1%, suggesting a low probability of exploitation. It is not listed in the CISA KEV catalog. The required attack vector is an authenticated contributor or higher who can add or modify the shortcode, after which the malicious script will run for any user who loads the affected page. This presents a moderate risk to site visitors whose browsers execute the injected code.