The Aparat Video Shortcode plugin contains an improper neutralization of input during web page generation that allows an attacker to store malicious JavaScript in the plugin’s content and have it executed whenever a page using the shortcode is viewed. This stored cross‑site scripting flaw, a form of CWE‑79, can lead to cookie theft, session hijacking, defacement, or the delivery of further malware to unsuspecting visitors.

The vulnerability affects WordPress sites running the Aparat Video Shortcode plugin by Ali Aghdam version 0.2.4 or earlier. Any installation that has not upgraded beyond 0.2.4 is susceptible, regardless of other plugins or themes.

The CVSS base score of 6.5 categorises the threat as moderate, and the EPSS score of < 1 % indicates a low likelihood of current exploitation. The flaw is not included in CISA’s KEV catalog, but the stored nature of the XSS enables a single attacker with the ability to submit content – either authenticated or through a trick that writes into the shortcode parameters – to inject arbitrary script. Because the injected payload is rendered on all visitors to the affected page, the impact can be widespread.