The ShortCode plugin for WordPress does not properly neutralize user input, allowing attacker‑supplied data to be stored and later rendered as part of a web page. This stored input can contain malicious JavaScript, giving the attacker the ability to run code in the browsers of visitors. The vulnerability a classic Stored Cross‑Site Scripting flaw and is classified as CWE‑79.

All WordPress sites using the maxpagels ShortCode plugin with a version of 0.8.1 or earlier are susceptible. The plugin injects improperly sanitized content into page output, making every user of the affected site a potential victim.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. The EPSS score of less than 1% suggests a low current probability of exploitation, and it is not catalogued in the CISA KEV list. Attacks would require an attacker to embed malicious code via the ShortCode feature, which is then stored and served to all site visitors—potentially enabling session hijacking, credential theft, or defacement of the site content.