The WP Masonry & Infinite Scroll WordPress plugin contains a stored XSS vulnerability in its 'wmis' shortcode that fails to sanitize or escape user‑provided attributes. Authenticated users with contributor‑level permissions can insert malicious code which will run in the browsers of any visitor who loads a page containing the injected shortcode. This flaw can be exploited to deface sites, steal session cookies, or redirect users to malicious resources. The weakness is an instance of CWE‑79 and is limited to users who can create or edit content in the WordPress admin area.

All installations of the WP Masonry & Infinite Scroll plugin up to and including version 2.2 are impacted. The plugin is authored by kaushik07 and distributed as a WordPress plugin. The vulnerability exists in every page that utilizes the vulnerable shortcode; no OS or PHP version specifics are required.

The CVSS score of 6.4 indicates a moderate impact with the potential for significant compromise of confidentiality through script execution. The EPSS score of <1% suggests a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector likely requires authenticated access to the WordPress backend, but the damage is user‑wide once the malicious script is rendered. Because the flaw is stored and not remote, an attacker must first obtain contributor or higher privileges to inject the code.