The plugin stored user‑supplied attributes in a shortcode handler that performed no input sanitization or output escaping. An attacker with contributor‑level access can inject JavaScript into the stored data, which will run whenever a visitor loads a page including the shortcode. This can lead to session hijacking, credential theft, or defacement of the site content, but it does not provide direct remote code execution on the server.

The vulnerability applies to the WP Easy Contact plugin for WordPress from emarket‑design, versions 4.0.0 and earlier. Versions released after 4.0.0 are not listed as affected and are presumed to contain the fix.

The CVSS score of 6.4 categorizes this as a moderate severity issue. The EPSS indicates a very low exploitation probability (<1%) and it is not yet listed in CISA’s KEV catalog. However, because any authenticated contributor can exploit it via the shortcode feature, an attacker who has gained access to the site with contributor privileges could effectively deliver the exploit. The attack path requires the attacker to create or edit content that includes the vulnerable shortcode, so knowledge of where the plugin is used and the ability to publish content are prerequisites.