The Hide It plugin for WordPress permits users with contributor-level or higher privileges to provide attributes to its hideit shortcode without proper sanitization or escaping. This flaw allows an attacker to embed arbitrary JavaScript that is stored and later rendered when any user views a page containing the shortcode. The attack forces the user’s browser to execute malicious code in the context of the site, resulting in a classic stored cross‑site scripting vulnerability.

WordPress installations that use the Hide It plugin version 1.0.1 or earlier. The vendor, jason‑lau, publishes the Hide It product through the official WordPress plugin repository.

The CVSS score of 6.4 indicates moderate severity. An EPSS score of <1% denotes a low probability of exploitation at the time of analysis, and the vulnerability is not represented in the CISA KEV catalog. Exploitation requires an authenticated user with contributor or higher privileges, making the attack vector rely on legitimate access to the site. Once a malicious payload is introduced, any subsequent visitor to the affected page will trigger the stored script.