The vulnerability lies in insufficient input sanitization within the Tournament Bracket Generator’s ‘bracket’ shortcode. Authenticated users with contributor or higher privileges can embed malicious scripts as shortcode attributes that are stored in the database without escaping. When any site visitor accesses a page containing the injected shortcode, the malicious script executes in that visitor’s browser, allowing attackers to steal session data, deface content, or dispatch further payloads. This flaw is a classic stored XSS vulnerability identified as CWE‑79.

Blakelong’s Tournament Bracket Generator plugin for WordPress, all releases up to and including version 1.0.0, is affected. Users running any of those versions on a WordPress installation are vulnerable; no other vendors or products are listed as impacted.

The CVSS base score of 6.4 indicates moderate to high severity. The EPSS score is under 1 %, implying a low but non‑zero likelihood of exploitation. The vulnerability is not included in the CISA KEV catalog. Exploitation requires authentication with contributor or higher role; an attacker could then post content that includes a malicious shortcode, causing the payload to run on all visitors who view the affected page.