The Links shortcode plugin includes improper input neutralization in a stored data context, enabling a Stored XSS attack. When the plugin stores user‑supplied input in a post or page, the resulting script can execute in any browser that views the content, allowing attackers to hijack user sessions, deface pages, or perform phishing. This vulnerability is identified as CWE‑79 and carries a CVSS score of 6.5.

WordPress websites using the Maarten Links shortcode plugin version 1.8.3 or earlier are impacted. The issue spans all releases from the first available version through 1.8.3. The plugin is listed under the vendor Maarten and is identified by the short name links‑shortcode.

The CVSS base score of 6.5 signifies a moderate risk, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation campaigns. Attackers would need write access to content that uses the shortcode to inject malicious payloads, after which any visitor to that content could be exposed to the stored script.