A reflected XSS flaw in the Arconix Shortcodes WordPress plugin allows attackers to inject malicious script into pages rendered for users. Improper neutralization of input can lead to session hijacking, defacement, or theft of credentials when victims view crafted URLs or submit manipulated forms. The vulnerability is a classic CWE‑79 injection issue that undermines the confidentiality and integrity of user data.

The Arconix Shortcodes plugin from tychesoftwares, version 2.1.16 and earlier, is affected. All WordPress sites running these plugin releases are potentially vulnerable and should be inspected for the presence of the plugin.

The flaw carries a CVSS score of 7.1, indicating high severity. Its EPSS score of less than 1% shows that the likelihood of contemporary exploitation is low, and it is not listed in the CISA KEV catalog. Likely attack vectors involve delivering a crafted URL or form parameter that the plugin reflects without proper escaping, requiring user interaction with the injected content. The overall risk is moderate, with the impact contingent on the presence of the vulnerable plugin on exposed web interfaces.