The Freemind Viewer plugin for WordPress permits authenticated contributors or higher to inject arbitrary scripts via its 'freemind' shortcode. Because the plugin leaves user‑supplied attributes unsanitized and unescaped, each injected payload becomes stored in the database and will execute whenever a page containing the shortcode is viewed. This stored cross‑site scripting attack can expose session cookies, redirect users to malicious sites, or enable further compromise of the victim’s session or site content.

All WordPress installations that have installed the Freemind Viewer plugin version 1.0 or earlier are affected. The CNA lists the product as rsemeteys:Freemind Viewer, which corresponds to the plugin and any site instance running it.

The CVSS score of 6.4 classifies the vulnerability as moderate severity, and the low EPSS score (<1%) indicates that large‑scale exploitation is currently uncommon. The flaw requires an authenticated contributor or higher, which is typically granted to trusted content authors. Once an attacker gains such access, they can easily submit a malicious 'freemind' shortcode that will persist until the content is edited or the plugin removed. The vulnerability is not listed in the CISA KEV catalog, though it still represents a notable risk for sites accepting contributor content.