The BNS Featured Category plugin for WordPress is vulnerable to a stored cross‑site scripting flaw that allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript through the plugin’s shortcode attributes. Because the input data are not properly sanitized or escaped, malicious scripts can be persisted to the database and executed every time a user views the affected page. This jeopardizes the confidentiality and integrity of users’ browsers, potentially leading to session hijacking, credential theft, or defacement of site content.

WordPress installations using the BNS Featured Category plugin version 2.8.2 or earlier are affected. Any site that has this plugin activated and allows contributors or higher roles to edit content is at risk.

The vulnerability has a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1 %, meaning that, as of now, the likelihood of exploitation is low. It is not listed in the CISA KEV catalog. Attackers can exploit this flaw by inserting malicious attributes into the shortcode in a post or page they can edit; the injected script then runs whenever any visitor loads that page.