The Runners Log plugin for WordPress contains a stored cross‑site scripting flaw in its 'runnerslog' shortcode, caused by inadequate sanitization and escaping of user supplied attributes. The vulnerability allows an authenticated user with contributor-level or higher privileges to inject arbitrary JavaScript that is stored in the database and executed when any site visitor loads a page containing the shortcode. This can lead to defacement, session hijacking, and theft of sensitive information.

All instances of the Runners Log plugin with a version number up to and including 3.9.2 are affected. The flaw impacts WordPress sites using this plugin and requires that the attacker has contributor or higher role access to insert the malicious shortcode into pages or posts that employ the runnerslog tag.

With a CVSS score of 6.4 the vulnerability is considered moderate. The EPSS score of less than 1% indicates that exploitation is currently unlikely, and the flaw is not listed in the CISA KEV catalog. An attacker requires valid contributor‑level credentials to create or edit content containing the shortcode; once an injection is stored, every visitor to that page will execute the injected code, making the attack straightforward once the privilege threshold is met.