An attacker can inject malicious scripts via the PenciShortcodes & Performance plugin, enabling DOM‑based cross‑site scripting. The flaw arises from improper neutralization of user input during web page generation, allowing arbitrary JavaScript execution on the victim’s browser. This can lead to cookie theft, session hijacking, defacement, or delivery of malware. The weakness corresponds to CWE‑79.

WordPress sites running the PenciDesign Penci Shortcodes & Performance plugin, any release before 6.1, are vulnerable. The problem applies to all users who view any page rendering the plugin’s shortcodes, regardless of role.

The CVSS score of 6.5 indicates a moderate severity. The EPSS of less than 1% suggests a low probability of exploitation in the wild. The attack can be performed by simply visiting a crafted URL or embedded link; no authentication is required. The vulnerability is listed in the CISA KEV catalog as not included, implying it is not a known, actively exploited vulnerability. Despite the low exploitation likelihood, the impact on confidentiality, integrity, or availability warrants timely patching.