Rescue Shortcodes allows attackers to inject malicious JavaScript into pages stored by the plugin. The improper neutralization of input during page generation is a stored cross‑site scripting condition (CWE‑79). Attackers could execute scripts in the browsers of anyone who views the affected content, potentially stealing credentials, session cookies, or injecting further malicious content. The likely attack vector is through the plugin’s shortcode interface, where an attacker can submit malicious content that is then rendered to all visitors without proper encoding, although this inference is based on the available description.

The vulnerability affects the Rescue Themes Rescue Shortcodes plugin from its earliest releases up through version 3.3. All WordPress installations that employ any version within this range are vulnerable.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of < 1 % suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalogue. Attackers can exploit the flaw by submitting malicious content through the plugin’s shortcode interface, which is then stored and rendered to all visitors without proper encoding.