The vulnerability resides in the Daisycon prijsvergelijkers WordPress plugin. The plugin’s ‘daisycon_uitvaart’ shortcode does not properly sanitize or escape user supplied attributes, allowing an authenticated contributor to store malicious JavaScript in the site’s content. When a page containing that shortcode is viewed, the injected script is executed in the visitor’s browser, which can lead to session hijacking, cookie theft, defacement, or the execution of additional payloads on compromise of users.

All installations of Daisycon prijsvergelijkers up to version 4.9.0 are affected. The vulnerability is particular to the WordPress environment and requires the presence of the plugin. Versions beyond 4.9.0 are not known to be compromised. WordPress sites that have granted contributor-level or higher roles are at risk.

The CVSS score of 6.4 indicates moderate overall risk, and the EPSS value of less than 1% shows a very low likelihood of exploitation at present. The vulnerability has not been reported in the CISA KEV catalog, suggesting limited evidence of active exploitation. A likely attack path would involve a user with contributor privileges inserting a malicious attribute into the shortcode via the WordPress editor, which then persists until the content is viewed. Because the script is stored, it may impact all users who load the affected page.