Improper neutralization of input during web page generation allows attackers to store malicious scripts in content processed by the JSM file_get_contents() Shortcode. When a victim views the affected page, the injected script runs in their browser, potentially enabling cookie theft, session hijacking, or other client‑side attacks. The weakness is an example of CWE‑79. This vulnerability can compromise the confidentiality and integrity of user data and compromise the use of the website.

The vulnerability affects the WordPress plugin JSM file_get_contents() Shortcode by JS Morisset. All installations running version 2.7.1 or earlier are impacted. No specific sub‑component of the plugin is listed, so the entire plugin range up to 2.7.1 is vulnerable.

The CVSS score of 6.5 indicates medium severity. The EPSS score is less than 1 percent, suggesting a very low likelihood of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via the plugin’s shortcode mechanism, where an attacker can embed malicious payloads into stored content that will later be rendered on the site. No additional access or privilege prerequisites are mentioned, implying that the vulnerability may be exploitable by any user who can submit content processed by the plugin.